CVE-2025-5275

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-5275", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-05-27T13:37:54.171Z", "datePublished": "2025-06-26T02:22:21.725Z", "dateUpdated": "2026-04-08T16:49:32.375Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:49:32.375Z"}, "affected": [{"vendor": "smub", "product": "Charitable \u2013 Donation Plugin for WordPress \u2013 Fundraising with Recurring Donations & More", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.8.6.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Charitable \u2013 Donation Plugin for WordPress \u2013 Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the privacy settings fields in all versions up to, and including, 1.8.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.\r\nThis issue was partially fixed in version 1.8.6.1 and fully fixed in version 1.8.6.2."}], "title": "Charitable <= 1.8.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Privacy Settings", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/453d8918-32dc-43d6-8969-71f719536891?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/charitable/tags/1.8.5.3/templates/form-fields/checkbox.php#L40"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "timeline": [{"time": "2025-03-26T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-06-25T14:11:07.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-26T13:23:29.823726Z", "id": "CVE-2025-5275", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-26T13:23:40.397Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-5275", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-06-26T13:23:29.823726Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-26T13:23:36.700Z"}}], "cna": {"title": "Charitable <= 1.8.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Privacy Settings", "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "smub", "product": "Charitable \u2013 Donation Plugin for WordPress \u2013 Fundraising with Recurring Donations & More", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.8.6.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-03-26T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-06-25T14:11:07.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/453d8918-32dc-43d6-8969-71f719536891?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/charitable/tags/1.8.5.3/templates/form-fields/checkbox.php#L40"}], "descriptions": [{"lang": "en", "value": "The Charitable \u2013 Donation Plugin for WordPress \u2013 Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the privacy settings fields in all versions up to, and including, 1.8.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.\r\nThis issue was partially fixed in version 1.8.6.1 and fully fixed in version 1.8.6.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-06-26T02:22:21.725Z"}}}, "cveMetadata": {"cveId": "CVE-2025-5275", "state": "PUBLISHED", "dateUpdated": "2025-06-26T13:23:40.397Z", "dateReserved": "2025-05-27T13:37:54.171Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-06-26T02:22:21.725Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Charitable \u2013 Donation Plugin for WordPress \u2013 Fundraising with Recurring Donations & More", "vendor": "smub", "versions": [{"lessThanOrEqual": "1.8.6.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wpbeginner:charitable:*:*:*:*:-:wordpress:*:*", "matchCriteriaId": "21B0B881-56D7-48CE-B685-4EFE1DF4A056", "versionEndExcluding": "1.8.6.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Charitable \u2013 Donation Plugin for WordPress \u2013 Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the privacy settings fields in all versions up to, and including, 1.8.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.\r\nThis issue was partially fixed in version 1.8.6.1 and fully fixed in version 1.8.6.2."}, {"lang": "es", "value": "El complemento Charitable \u2013 Donation Plugin para WordPress \u2013 Fundraising with Recurring Donations &amp; More para WordPress es vulnerable a cross site scripting almacenado a trav\u00e9s de los campos de configuraci\u00f3n de privacidad en todas las versiones hasta la 1.8.6.1 incluida, debido a una depuraci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a atacantes autenticados, con acceso de administrador, inyectar scripts web arbitrarios en las p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada. Esto solo afecta a instalaciones multisitio y a instalaciones donde se ha deshabilitado unfiltered_html. Este problema se solucion\u00f3 parcialmente en la versi\u00f3n 1.8.6.1 y completamente en la 1.8.6.2."}], "id": "CVE-2025-5275", "lastModified": "2026-06-17T09:47:35.753", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-5275", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-06-26T13:23:29.823726Z", "version": "2.0.3"}}]}, "published": "2025-06-26T03:15:23.860", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/charitable/tags/1.8.5.3/templates/form-fields/checkbox.php#L40"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/453d8918-32dc-43d6-8969-71f719536891?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T01:14:26.299376+00:00", "value": {"mitigation_remediation": ["Upgrade the Charitable plugin to version\u202f1.8.6.2 or later to remove the vulnerable code paths.", "After upgrading, check all privacy setting entries for residual or injected scripts and delete them if present.", "Re\u2011audit the WordPress environment to ensure no other plugins or custom code introduce similar stored XSS vulnerabilities."], "summary": {"action": "Patch Now", "impact": "Stored XSS (Authenticated Administrative)"}, "threat_synthesis": {"affected_systems": "This issue affects installations of the Charitable plugin for WordPress (smub:Charitable) up to and including version 1.8.6.1. Only multi\u2011site WordPress environments that have the unfiltered_html feature disabled are vulnerable. The problem was partially addressed in 1.8.6.1 and fully resolved in 1.8.6.2.", "description_and_impact": "The vulnerability is a stored cross\u2011site scripting flaw within the privacy settings fields of the Charitable WordPress plugin. Because input sanitization and output escaping are insufficient, an attacker who has administrator privileges can embed arbitrary JavaScript. This weakness aligns with CWE-79, Cross\u2011Site Scripting. When an end\u2011user visits the affected page, the script executes in the user\u2019s browser, potentially allowing data theft, session hijacking, or defacement. The flaw is confined to stored data and does not require user interaction beyond loading the page.", "risk_and_exploitability": "The CVSS score of 4.4 indicates a medium impact, and the EPSS score of less than 1\u202f% signals a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting no documented exploitation yet. Attackers must first authenticate as an administrator, then input malicious code into the privacy settings; there are no public exploits known, so the risk is moderate but low in terms of current exploitability."}}}}, "created": "2026-04-22T01:15:07.315735+00:00", "updated": "2026-04-22T01:15:07.315746+00:00", "vendors": []}