CVE-2025-5275 in Charitable Plugin
Summary
by MITRE • 06/26/2025
The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the privacy settings fields in all versions up to, and including, 1.8.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. This issue was partially fixed in version 1.8.6.1 and fully fixed in version 1.8.6.2.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/08/2025
The vulnerability identified as CVE-2025-5275 affects the Charitable – Donation Plugin for WordPress, a widely used fundraising solution that supports recurring donations and related features. This plugin has been installed on numerous WordPress websites, making it a potentially significant attack vector for malicious actors targeting donation-based organizations. The flaw exists specifically within the privacy settings fields of the plugin's configuration interface, where user input is not properly sanitized or escaped before being stored in the database. This vulnerability represents a classic stored cross-site scripting vulnerability that allows attackers to inject malicious scripts into the plugin's settings, which will then execute whenever any user accesses the affected pages. The vulnerability is particularly concerning because it requires only administrator-level access to exploit, meaning that attackers who have gained administrative privileges on a WordPress site can leverage this weakness to persistently compromise the system.
The technical nature of this vulnerability stems from inadequate input sanitization and output escaping mechanisms within the plugin's codebase. When administrators configure privacy settings through the WordPress admin interface, the plugin fails to properly validate or escape user-provided input before storing it in the database. This creates a persistent XSS condition where malicious scripts can be stored and executed in the context of any user's browser who accesses pages that contain the injected content. The vulnerability is classified under CWE-79 as a Cross-Site Scripting flaw, specifically manifesting as a stored XSS vulnerability that allows attackers to inject malicious scripts that execute in the context of other users' browsers. The attack requires an authenticated administrator account to exploit, which aligns with the ATT&CK technique T1078.004 for valid accounts and T1547.001 for privilege escalation through administrative access.
The operational impact of this vulnerability extends beyond simple script execution, as it can enable attackers to perform various malicious activities including session hijacking, data exfiltration, and further privilege escalation within the compromised WordPress environment. In multi-site installations, the vulnerability becomes even more dangerous because the malicious scripts could potentially affect multiple sites within the network, amplifying the attack surface. The restriction that this only affects multi-site installations and installations where unfiltered_html has been disabled provides some mitigation, but does not eliminate the risk entirely. Organizations using this plugin in environments where administrators have elevated privileges and where the plugin is actively used for privacy configuration are at heightened risk. The vulnerability was partially addressed in version 1.8.6.1 but fully resolved in version 1.8.6.2, indicating that the developers recognized the severity of the issue and implemented proper input validation and output escaping measures. The fix demonstrates adherence to secure coding practices by ensuring that all user inputs are properly sanitized before storage and appropriately escaped before output to prevent XSS execution. This vulnerability highlights the critical importance of proper input validation and output escaping in web applications, particularly in plugins that handle sensitive configuration data and user inputs. Organizations should immediately upgrade to version 1.8.6.2 or later to mitigate this risk and ensure that their donation management systems remain secure against persistent XSS attacks.