CVE-2025-15675 in Charitable Plugin
Summary
by MITRE • 08/02/2026
The Charitable WordPress plugin before 1.8.5.3 does not sanitise and escape one of its campaign image text fields before outputting it in an HTML attribute, allowing users with a high-privilege campaign-management role to perform Stored Cross-Site Scripting attacks that execute on the front-end campaign page.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/02/2026
The Charitable WordPress plugin vulnerability represents a critical stored cross-site scripting flaw that affects versions prior to 1853. This security weakness resides in the plugin's handling of campaign image text fields within its administrative interface. The vulnerability stems from insufficient input sanitization and output escaping mechanisms that fail to properly validate user-supplied data before rendering it in HTML attributes. Attackers with high-privilege campaign-management roles can exploit this weakness by injecting malicious JavaScript code through the campaign image text field, which then executes when the front-end campaign page loads. The flaw specifically manifests when the plugin outputs unfiltered user input directly into HTML attributes without proper context-aware escaping, creating a persistent XSS vector that affects all users who view the compromised campaign page.
The technical implementation of this vulnerability aligns with CWE-79 - Improper Neutralization of Input During Web Page Generation, which encompasses stored XSS vulnerabilities where malicious scripts are permanently stored on the target server and executed when accessed by other users. This weakness operates at the application layer of the OSI model, specifically within the web application's data processing and output generation components. The vulnerability is particularly concerning because it requires minimal privileges for exploitation, as the campaign-management role typically has legitimate access to modify campaign content, making the attack vector both accessible and potentially devastating. When an attacker successfully injects malicious code, the XSS payload executes in the context of the victim's browser session, potentially leading to session hijacking, credential theft, or redirection to malicious sites.
The operational impact of this vulnerability extends beyond simple script execution, as it enables attackers to perform various malicious activities that could compromise entire user bases. The stored nature of the vulnerability means that once exploited, the malicious payload persists indefinitely until manually removed from the plugin's database storage. This creates a persistent threat that can affect multiple users over extended periods. Attackers could leverage this vulnerability to redirect users to phishing sites, steal session cookies, or even modify campaign content to spread malware. The vulnerability affects the front-end campaign pages where the malicious code executes, potentially disrupting legitimate business operations and damaging the organization's reputation. Security teams must consider the potential for data exfiltration and the broader implications for user trust when addressing this type of vulnerability.
Mitigation strategies for this Charitable plugin vulnerability should include immediate patching to version 1.8.5.3 or later, which contains the necessary input sanitization and output escaping fixes. Organizations should also implement additional security measures such as content security policies that restrict script execution on campaign pages, regular monitoring of user-generated content for suspicious patterns, and privileged access controls to limit who can modify campaign data. The implementation of proper input validation frameworks and output escaping routines should be enforced across all plugin components handling user-supplied data, following established security best practices such as those outlined in the OWASP Top Ten. Additionally, organizations should conduct regular security assessments of their WordPress plugins and maintain up-to-date vulnerability scanning processes to identify similar weaknesses before they can be exploited by malicious actors.
This vulnerability demonstrates the importance of proper security hygiene in content management systems where user-generated content is processed and displayed. The flaw highlights how seemingly benign input fields can become attack vectors when proper sanitization controls are absent from the application logic. From an ATT&CK perspective, this vulnerability maps to T1566 - Phishing and T1059 - Command and Scripting Interpreter, as it enables attackers to deliver malicious payloads through compromised campaign pages. Organizations should treat such vulnerabilities as potential entry points for more extensive attacks, implementing defense-in-depth strategies that include network monitoring, user behavior analytics, and regular security training to prevent exploitation of similar weaknesses in other plugin components or core WordPress functionality.