CVE-2025-5275
BaseFortify
Publication date: 2025-06-26
Last updated on: 2025-07-08
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wpbeginner | charitable | to 1.8.6.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Stored Cross-Site Scripting (XSS) issue in the Charitable – Donation Plugin for WordPress. It occurs via the privacy settings fields in versions up to and including 1.8.6.1 due to insufficient input sanitization and output escaping. Authenticated attackers with administrator-level access can inject malicious web scripts that execute whenever a user accesses the injected page. This affects multi-site installations and installations where unfiltered_html is disabled. The vulnerability was partially fixed in version 1.8.6.1 and fully fixed in 1.8.6.2.
How can this vulnerability impact me? :
The vulnerability allows an attacker with administrator privileges to inject arbitrary scripts into pages, which execute when other users view those pages. This can lead to unauthorized actions, data theft, session hijacking, or defacement of the website. Since it is a stored XSS, the malicious script persists and affects multiple users, potentially compromising the security and integrity of the affected WordPress multi-site installation.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if your WordPress installation uses the Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin at version 1.8.6.1 or earlier, especially in multi-site setups or where unfiltered_html is disabled. Since the vulnerability involves stored cross-site scripting via privacy settings fields, detection involves inspecting these fields for injected scripts. There are no specific commands provided in the resources to detect this vulnerability on your system or network.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability immediately, update the Charitable plugin to version 1.8.6.2 or later, where the issue is fully fixed. If updating is not immediately possible, restrict administrator-level access to trusted users only, and ensure that unfiltered_html is enabled or carefully monitor and sanitize inputs in privacy settings fields to prevent script injection. Additionally, consider disabling multi-site installations if not required.