CVE-2025-3781

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-3781", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-04-17T22:31:06.698Z", "datePublished": "2025-05-21T09:21:49.308Z", "dateUpdated": "2026-04-08T16:33:55.032Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:33:55.032Z"}, "affected": [{"vendor": "creativefreedomau", "product": "Raisely Donation Form", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Raisely Donation Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's raisely_donation_form shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Raisely Donation Form <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via raisely_donation_form Shortcode", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0716485b-e94b-4e09-9c01-1059017bfcc8?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/raisely-donation-form/trunk/inc/base/providers/shortcodes.php#L46"}, {"url": "https://wordpress.org/plugins/raisely-donation-form/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3302489/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Peter Thaleikis"}], "timeline": [{"time": "2025-05-20T20:32:42.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-21T10:11:50.653428Z", "id": "CVE-2025-3781", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-21T10:16:49.932Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-3781", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-21T10:11:50.653428Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-21T10:11:52.867Z"}}], "cna": {"title": "Raisely Donation Form <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via raisely_donation_form Shortcode", "credits": [{"lang": "en", "type": "finder", "value": "Peter Thaleikis"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "creativefreedomau", "product": "Raisely Donation Form", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-05-20T20:32:42.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0716485b-e94b-4e09-9c01-1059017bfcc8?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/raisely-donation-form/trunk/inc/base/providers/shortcodes.php#L46"}, {"url": "https://wordpress.org/plugins/raisely-donation-form/#developers"}], "descriptions": [{"lang": "en", "value": "The Raisely Donation Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's raisely_donation_form shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-05-21T09:21:49.308Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3781", "state": "PUBLISHED", "dateUpdated": "2025-05-21T10:16:49.932Z", "dateReserved": "2025-04-17T22:31:06.698Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-05-21T09:21:49.308Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Raisely Donation Form", "vendor": "creativefreedomau", "versions": [{"lessThanOrEqual": "1.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Raisely Donation Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's raisely_donation_form shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento Raisely Donation Form para WordPress es vulnerable a Cross-Site Scripting almacenado a trav\u00e9s del shortcode \"raisely_donation_form\" en todas las versiones hasta la 1.0 incluida, debido a una depuraci\u00f3n de entrada insuficiente y al escape de salida en los atributos proporcionados por el usuario. Esto permite a atacantes autenticados, con acceso de colaborador o superior, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada."}], "id": "CVE-2025-3781", "lastModified": "2026-06-17T09:20:39.503", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-3781", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-05-21T10:11:50.653428Z", "version": "2.0.3"}}]}, "published": "2025-05-21T12:16:21.677", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/raisely-donation-form/trunk/inc/base/providers/shortcodes.php#L46"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3302489/"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/raisely-donation-form/#developers"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0716485b-e94b-4e09-9c01-1059017bfcc8?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-28T01:33:31.444851+00:00", "value": {"mitigation_remediation": ["Upgrade Raisely Donation Form to the latest available version (1.2 or newer) which removes the insecure attribute handling.", "If an upgrade is not immediately possible, restrict use of the raisely_donation_form shortcode to trusted administrators and remove or disable it from all other user roles.", "Enable WordPress\u2019s built\u2011in XSS protection by activating the Content Security Policy (CSP) and applying a plugin that sanitizes user input before rendering shortcodes."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2013Site Scripting in Raisely Donation Form"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the \"Raisely Donation Form\" plugin distributed by Creative Freedom AU. Systems running any version of the plugin through 1.1 are impacted. The plugin is typically installed as a WordPress site component and can be accessed by site contributors and administrators.", "description_and_impact": "The Raisely Donation Form plugin for WordPress contains a stored Cross\u2011Site Scripting vulnerability in all releases up to and including 1.1. Through the raisely_donation_form shortcode, insufficient input sanitization and output escaping allow an attacker who can authenticate with contributor\u2011level access or higher to embed arbitrary JavaScript. When a user views a page containing the injected shortcode, the script executes in the victim\u2019s browser. This can lead to cookie theft, session hijacking, defacement, or phishing under the victim\u2019s security context.", "risk_and_exploitability": "The CVSS score of 6.4 flags medium severity, while the EPSS score of less than 1% indicates a low but non\u2011zero probability of exploitation. The weakness is not listed in the CISA KEV catalog. Exploitation requires authenticated access at the contributor level or higher, making it an implicit local attack vector. Because the attacker can run scripts in the context of any site visitor, the impact on confidentiality, integrity, or availability can be significant if the malicious code performs credential theft or defacement."}}}}, "created": "2025-07-12T22:23:23.683885+00:00", "updated": "2026-04-28T01:45:18.314138+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}