CVE-2026-93885: Cryptocurrency Donation Box <= 2.2.13 - Unauthenticated Stored Cross-Site Scripting via data_object Parameter
The Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dataobject Parameter in all versions up to, and including, 2.2.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by unauthenticated attackers because the cdbbcpaymentverify AJAX action is registered under wpajaxnopriv and its only authentication gate — a nonce check — is bypassable, as the cdbbcdonationbox nonce is publicly exposed to anonymous visitors via the walletsdata JavaScript object emitted by the [crypto-donation-box] shortcode.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require a WordPress account or user interaction from the attacker?
No. The affected AJAX action is available to unauthenticated users through wp_ajax_nopriv_. Although it checks a nonce, anonymous visitors can obtain that nonce from the wallets_data JavaScript object emitted by the [crypto-donation-box] shortcode.
Which sites are exposed to this issue?
Sites using Cryptocurrency Donation Box – Bitcoin & Crypto Donations version 2.2.13 or earlier are affected. Exploitation depends on the [crypto-donation-box] shortcode being rendered so that the public nonce is exposed to anonymous visitors.
What is the practical impact of a successful exploit?
An unauthenticated attacker can store arbitrary script through the data_object parameter. The script executes in the browser whenever a user accesses a page containing the injected content, potentially affecting confidentiality and integrity in that user’s browser context.