CVE-2026-104394: WordPress Charitable plugin <= 1.8.12.3 - Cross Site Scripting (XSS) vulnerability

Q: Who can exploit this issue?

The issue is described as unauthenticated, so an attacker does not need a WordPress account or plugin-specific privileges to attempt exploitation. The CVSS vector indicates network access and low attack complexity.

Q: Does exploitation require someone to interact with attacker-controlled content?

Yes. The CVSS vector includes user interaction (UI:R), indicating that exploitation requires a user to take some action, such as viewing or interacting with crafted content.

Q: Which installations are affected?

WordPress sites using the Charitable plugin at version 1.8.12.3 or earlier are identified as affected. The provided data does not state whether any particular plugin configuration is required.

Q: What impact can successful exploitation have?

The supplied CVSS vector indicates low impacts to confidentiality, integrity, and availability, with scope changed. The issue is classified as cross-site scripting, meaning attacker-supplied script could execute in a user's browser context.

Published Oct 6, 2026

Updated

Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions.

Affected Software

1 affected component

WordPress Charitable plugin<=1.8.12.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Charitable plugin to a version that resolves this vulnerability.
Fixed in 1.8.13

Event History

Oct 6, 2026

CVE Published

via MITRE·08:35 AM

Data Sourced

via MITRE·08:35 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The issue is described as unauthenticated, so an attacker does not need a WordPress account or plugin-specific privileges to attempt exploitation. The CVSS vector indicates network access and low attack complexity.

Does exploitation require someone to interact with attacker-controlled content?

Yes. The CVSS vector includes user interaction (UI:R), indicating that exploitation requires a user to take some action, such as viewing or interacting with crafted content.

Which installations are affected?

WordPress sites using the Charitable plugin at version 1.8.12.3 or earlier are identified as affected. The provided data does not state whether any particular plugin configuration is required.

What impact can successful exploitation have?

The supplied CVSS vector indicates low impacts to confidentiality, integrity, and availability, with scope changed. The issue is classified as cross-site scripting, meaning attacker-supplied script could execute in a user's browser context.

CVE-2026-104394: WordPress Charitable plugin <= 1.8.12.3 - Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Does exploitation require someone to interact with attacker-controlled content?

Which installations are affected?

What impact can successful exploitation have?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Does exploitation require someone to interact with attacker-controlled content?

Which installations are affected?

What impact can successful exploitation have?