Threats tagged 'ghsa-pwhm-f4mm-grcw'

CVE-2025-15675 is a stored Cross-Site Scripting (XSS) vulnerability in the Charitable WordPress plugin versions before 1.8.5.3. It arises because one of the campaign image text fields is not properly sanitized or escaped before being output in an HTML attribute. This flaw allows users with a high-privilege campaign-management role to inject malicious scripts that execute on the front-end campaign page.