CVE-2025-12020: Double Donation WordPress Plugin XSS Flaw

CVE-2025-12020 Overview

CVE-2025-12020 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Double the Donation WordPress plugin, a workplace giving tool used to support fundraising efforts. The flaw affects all versions up to and including 3.0.0. The plugin fails to properly sanitize input and escape output in its administrator settings, allowing authenticated users with administrator-level permissions to inject arbitrary JavaScript into plugin-managed pages. Injected scripts execute in the browser of any user who accesses the affected page. Exploitation is limited to WordPress multi-site installations and single-site installations where the unfiltered_html capability has been disabled.

Critical Impact
An authenticated administrator on a multi-site installation can persist JavaScript that executes against Super Admins and site visitors, enabling session theft, account takeover, or redirection to attacker-controlled infrastructure.

Affected Products

Double the Donation WordPress plugin versions <= 3.0.0
WordPress multi-site installations running the affected plugin
WordPress installations where unfiltered_html capability has been disabled

Discovery Timeline

2025-11-11 - CVE-2025-12020 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12020

Vulnerability Analysis

The vulnerability resides in the plugin's administrator settings handling logic. Values submitted through the plugin's settings interface are stored in the WordPress options table without adequate sanitization. When those values are later rendered into administrative or front-end pages, the plugin fails to apply proper output escaping. This allows arbitrary HTML and JavaScript payloads supplied during configuration to persist in the database and execute in the browser context of any user viewing the affected page.

Because WordPress normally grants site administrators the unfiltered_html capability, the class of user who can trigger this issue would already be permitted to inject raw HTML on standard single-site installs. The security boundary only becomes meaningful in WordPress multi-site environments, where site administrators do not receive unfiltered_html by default, and in installations that explicitly revoke the capability. In those contexts, the plugin becomes a vehicle for a subordinate administrator to escalate influence against Super Admins or other privileged users.

Root Cause

The root cause is insufficient input sanitization when persisting settings and missing output escaping when rendering those settings. Functions such as sanitize_text_field(), wp_kses(), or context-specific escapers like esc_attr() and esc_html() were not consistently applied. See the WordPress Plugin Changeset Update for the corrective code changes.

Attack Vector

An attacker with administrator-level access authenticates to the WordPress site and navigates to the Double the Donation settings screen. They submit a malicious payload in a vulnerable settings field. The payload is stored and subsequently rendered without escaping into a page. Any user who loads that page executes the attacker's script under the site's origin. Full technical context and the vulnerable code locations are documented in the Wordfence Vulnerability Report and the plugin source snippets at line 59 and line 79.

No verified public exploit code is available. The vulnerability mechanism is described in prose based on vendor and third-party advisories.

Detection Methods for CVE-2025-12020

Indicators of Compromise

Unexpected <script> tags, event handlers, or encoded JavaScript stored in WordPress wp_options or wp_sitemeta entries owned by the Double the Donation plugin.
Outbound requests from administrator browser sessions to unknown domains shortly after visiting pages rendered by the plugin.
Modifications to plugin settings performed by administrator accounts that do not normally manage fundraising configuration.

Detection Strategies

Review the WordPress options table for plugin-owned keys and inspect their values for HTML or JavaScript content that should not be present in configuration fields.
Correlate WordPress audit logs for update_option events tied to the Double the Donation plugin with the acting user and source IP.
Deploy Content Security Policy (CSP) reporting to surface inline script execution originating from administrative pages.

Monitoring Recommendations

Monitor administrator authentication events on multi-site installations for unusual geolocation, session duration, or plugin configuration activity.
Alert on any change to which accounts hold the unfiltered_html capability across the network.
Track plugin version inventory to identify sites still running Double the Donation 3.0.0 or earlier.

How to Mitigate CVE-2025-12020

Immediate Actions Required

Update the Double the Donation plugin to a version later than 3.0.0 that includes the fix from changeset 3393231.
Audit administrator accounts on all multi-site installations and remove access from users who do not require it.
Inspect current plugin settings for injected script payloads and remove any unauthorized content before restoring the pages.

Patch Information

The vendor addressed the vulnerability in a plugin update tracked by WordPress Plugin Changeset 3393231. Site operators should upgrade to the latest available release of the Double the Donation plugin through the WordPress plugin manager.

Workarounds

On multi-site installations, restrict site-level administrator assignments and require Super Admin review for plugin configuration changes.
Deploy a Web Application Firewall (WAF) rule set that blocks HTML and JavaScript payloads submitted to plugin settings endpoints.
Enforce a strict Content Security Policy that disallows inline scripts on WordPress administrative and public pages served by the plugin.

bash

# Configuration example: identify installations still running the vulnerable plugin
wp plugin get double-the-donation --field=version
wp plugin update double-the-donation