Threat database

CVE-2026-94159 is a stored cross-site scripting (XSS) vulnerability in KlbTheme's Total Donations plugin affecting versions up to and including 2.0.5. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. It has a high severity with a CVSS score of 7.1. No patch or remediation information is currently provided.

CVE-2026-73391 is a critical unauthenticated SQL Injection vulnerability affecting KlbTheme's Total Donations plugin versions up to 2.0.5. This flaw allows remote attackers to inject SQL commands without authentication, potentially leading to high confidentiality impact and limited availability impact. No patch information is provided, and no known exploits are reported in the wild.

CVE-2026-73390 is a critical vulnerability in KlbTheme's Total Donations plugin versions up to and including 2.0.5. It allows unauthenticated users to escalate privileges incorrectly due to improper privilege assignment (CWE-266). The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.