CVE-2026-92409: Donation Thermometer 2.2.9 - 2.2.11 - Contributor+ Stored XSS via Shortcode
Published Oct 14, 2026
·Updated
The Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour value taken from a shortcode attribute before using it in an attribute of the generated legend markup, allowing users with the Contributor role and above to inject arbitrary event handlers that execute when the page is viewed.
Affected Software
1 affected component
WordPress Donation Thermometer<2.3.0
Event History
Oct 14, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Frequently Asked Questions
1
Who can exploit this issue?
A user with the WordPress Contributor role or any higher-privileged role can exploit it by supplying a crafted colour value in the plugin shortcode.
2
When does the injected code execute?
The injected event handler executes when a page containing the crafted shortcode is viewed.
3
Which plugin versions are affected?
Donation Thermometer versions 2.2.9 through 2.2.11 are affected. Versions before 2.3.0 do not escape the shortcode colour attribute value.