CVE-2026-92409 in Donation Thermometer Plugin

Сводка

по MITRE • 14.10.2026

The Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour value taken from a shortcode attribute before using it in an attribute of the generated legend markup, allowing users with the Contributor role and above to inject arbitrary event handlers that execute when the page is viewed.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

• Ответственный: WPScan
• Резервировать: 16.09.2026
• Раскрытие: 14.10.2026
• Модерация: принято
• Вход: VDB-419316
• CPE: 20261014
• CWE: CWE-79 (Подтверждённый)
• CVSS: 3.5 (VulDB)
• EPSS: 0.00000
• KEV: Нет
• Деятельности: Очень низкий
• Сектор: Hostingprovider

Источники

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-92409
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-92409
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-92409/