CVE-2025-15675 Overview
CVE-2025-15675 is a Stored Cross-Site Scripting (XSS) vulnerability in the Charitable WordPress plugin versions before 1.8.5.3. The plugin fails to sanitize and escape one of its campaign image text fields before rendering it inside an HTML attribute on the front-end campaign page. Users with a high-privilege campaign-management role can inject JavaScript that executes in the browsers of visitors and other authenticated users viewing the affected campaign. The issue is categorized under [CWE-79], Improper Neutralization of Input During Web Page Generation.
Critical Impact
Authenticated campaign managers can inject persistent JavaScript that runs on public campaign pages, enabling session theft, credential harvesting, and administrative account takeover through crafted attribute payloads.
Affected Products
- Charitable WordPress plugin versions prior to 1.8.5.3
- WordPress sites accepting donations through Charitable campaigns
- Front-end campaign pages rendering unsanitized image text fields
Discovery Timeline
- 2026-08-02 - CVE-2025-15675 published to NVD
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2025-15675
Vulnerability Analysis
The Charitable plugin exposes campaign creation and management features to WordPress roles authorized to publish and edit campaigns. One of the image-related text fields associated with a campaign is written directly into an HTML attribute on the rendered campaign page without sufficient output encoding. Because the value is embedded in an attribute context, an attacker can break out of the attribute using quote characters and inject arbitrary JavaScript or event handlers.
Exploitation requires a high-privilege campaign-management account and user interaction with the affected campaign page. Once a malicious payload is stored, every visitor loading that campaign page executes attacker-controlled script in the site's origin. This enables theft of authentication cookies, forced administrative actions through forged requests, and delivery of secondary payloads to donors.
Root Cause
The root cause is missing output escaping when writing user-supplied campaign image text into an HTML attribute. The plugin does not apply WordPress attribute-escaping functions such as esc_attr() before rendering the field, allowing metacharacters like quotes and angle brackets to alter the surrounding markup.
Attack Vector
An attacker with a campaign-management role edits a target campaign and submits a payload in the vulnerable image text field. The payload is persisted to the database. When a visitor or administrator loads the campaign page, the browser parses the crafted attribute value and executes the injected script under the site's origin, completing the stored XSS chain.
The vulnerability mechanism is described in the WPScan Vulnerability Report. No public proof-of-concept code is required to describe the flaw beyond noting the missing esc_attr() call around the affected campaign image text field output.
Detection Methods for CVE-2025-15675
Indicators of Compromise
- Campaign records containing HTML metacharacters such as ", <, >, or on*= event handlers within image-related text fields.
- Unexpected <script> execution or outbound requests originating from /campaign/ or Charitable front-end URLs.
- New or modified WordPress administrator accounts following campaign edits by non-administrator campaign managers.
Detection Strategies
- Audit the wp_posts and Charitable meta tables for campaign image text fields containing quote characters, angle brackets, or JavaScript URI schemes.
- Inspect web server access logs for anomalous POST requests to Charitable campaign edit endpoints from campaign-management accounts.
- Deploy a web application firewall rule matching XSS payloads submitted to Charitable admin endpoints.
Monitoring Recommendations
- Alert on modifications to campaign posts made by non-administrator users, particularly changes to image metadata fields.
- Monitor browser-side content security policy (CSP) violations on public campaign pages to surface injected inline scripts.
- Track privilege changes and new administrator account creation immediately after campaign edits.
How to Mitigate CVE-2025-15675
Immediate Actions Required
- Update the Charitable plugin to version 1.8.5.3 or later on every WordPress instance where it is installed.
- Review all existing campaigns for stored payloads in image text fields and remove or sanitize suspicious entries.
- Rotate WordPress administrator and campaign-manager credentials if suspicious campaign edits are found.
Patch Information
The vendor addressed CVE-2025-15675 in Charitable version 1.8.5.3 by applying proper output escaping to the affected campaign image text field. Refer to the WPScan Vulnerability Report for advisory details and version guidance.
Workarounds
- Restrict the campaign-management role to a small set of trusted, MFA-protected accounts until patching is complete.
- Apply a WAF rule that blocks HTML metacharacters and JavaScript URI patterns in requests to Charitable campaign edit endpoints.
- Enforce a strict Content Security Policy on the WordPress site that disallows inline scripts on public campaign pages.
# Update Charitable via WP-CLI on the affected host
wp plugin update charitable --version=1.8.5.3
wp plugin get charitable --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
