CVE-2025-5275: Charitable <= 1.8.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Privacy Settings
The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the privacy settings fields in all versions up to, and including, 1.8.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfilteredhtml has been disabled. This issue was partially fixed in version 1.8.6.1 and fully fixed in version 1.8.6.2.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-5275?
CVE-2025-5275 is considered a high severity vulnerability due to the risk of Stored Cross-Site Scripting.
How do I fix CVE-2025-5275?
To fix CVE-2025-5275, update the Charitable Donation Plugin for WordPress to version 1.8.6.2 or later.
What types of attacks are possible due to CVE-2025-5275?
CVE-2025-5275 can lead to attacks such as data theft and session hijacking through Stored Cross-Site Scripting.
Which versions of the Charitable Donation Plugin for WordPress are affected by CVE-2025-5275?
CVE-2025-5275 affects all versions of the Charitable Donation Plugin for WordPress up to and including 1.8.6.1.
Is user data at risk due to CVE-2025-5275?
Yes, user data is at risk due to the potential for attackers to exploit the Stored Cross-Site Scripting vulnerability in CVE-2025-5275.