CVE-2026-92409

Deferred Deferred - Pending Action

Donation Thermometer Plugin DOM XSS via Shortcode Attribute

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: WPScan

Description

The Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour value taken from a shortcode attribute before using it in an attribute of the generated legend markup, allowing users with the Contributor role and above to inject arbitrary event handlers that execute when the page is viewed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-92409

EUVD

EUVD-2026-100863

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	Donation	Thermometer 2.2.9

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

The Donation Thermometer WordPress plugin before version 2.3.0 has a stored cross-site scripting (XSS) vulnerability. It fails to properly escape a color value from a shortcode attribute, allowing users with Contributor role or higher to inject malicious event handlers into the page's legend markup. These handlers execute when the page is viewed by others.

Detection Guidance

Check the installed version of the Donation Thermometer plugin. If it is between 2.2.9 and 2.2.11, the system is vulnerable. Use commands like 'wp plugin list' in WordPress or inspect the plugin directory for version details.

Impact Analysis

An attacker could inject malicious scripts that run when visitors view pages using the vulnerable plugin. This could lead to theft of cookies, session tokens, or other sensitive data. It may also allow redirection to phishing sites or defacement of the website.

Compliance Impact

This XSS vulnerability could expose user data, violating GDPR's requirement for data protection and user privacy. For HIPAA, it may compromise protected health information if exploited on healthcare-related sites. Both standards require safeguards against unauthorized data access or modification.

Mitigation Strategies

Update the Donation Thermometer plugin to version 2.3.0 or later immediately. Remove or disable the plugin if updating is not possible. Restrict user roles to prevent Contributor-level access to untrusted users.

Hi! I’m here to help you understand CVE-2026-92409. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70