CVE-2025-30770: Charitable Plugin DOM-Based XSS Vulnerability

CVE-2025-30770 Overview

CVE-2025-30770 is a DOM-based Cross-Site Scripting (XSS) vulnerability in the Syed Balkhi Charitable WordPress plugin. The flaw affects all versions of Charitable up to and including 1.8.4.7. Attackers can inject malicious scripts that execute in the context of a victim's browser session.

The vulnerability stems from improper neutralization of user-controlled input during web page generation [CWE-79]. Successful exploitation requires user interaction and low-privileged authenticated access. Impact spans confidentiality, integrity, and availability with scope change, meaning injected scripts can affect resources beyond the vulnerable component.

Critical Impact
Attackers with low-privileged access can execute arbitrary JavaScript in victim browsers, enabling session hijacking, credential theft, and unauthorized actions within the WordPress administrative context.

Affected Products

Syed Balkhi Charitable WordPress Plugin
All versions from initial release through 1.8.4.7
WordPress installations running the vulnerable Charitable donation plugin

Discovery Timeline

2025-03-27 - CVE-2025-30770 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30770

Vulnerability Analysis

The Charitable plugin fails to properly sanitize user-supplied input before it is written into the Document Object Model (DOM). This class of flaw is categorized as DOM-based XSS, where the injection and execution both occur in client-side JavaScript rather than in server-rendered responses.

Attackers craft input that reaches a vulnerable client-side sink such as innerHTML, document.write, or similar DOM manipulation functions. When a victim loads the affected page, the browser parses the attacker-controlled data as executable script. The scope change indicates that the injected code can access resources outside the initial security context of the plugin.

Root Cause

The root cause is missing or insufficient output encoding on user-influenced values before they are inserted into the DOM. Client-side JavaScript in the Charitable plugin trusts input that should be treated as untrusted, allowing HTML and script content to be rendered instead of escaped.

Attack Vector

Exploitation occurs over the network and requires user interaction, such as clicking a crafted link or visiting a page containing malicious parameters. The attacker needs low-privileged authenticated access to the target WordPress site. Once triggered, the payload executes in the victim's browser session under the origin of the WordPress site.

The vulnerability mechanism is described in the Patchstack Charitable XSS Vulnerability advisory. No public proof-of-concept code is available in the referenced sources.

Detection Methods for CVE-2025-30770

Indicators of Compromise

Unexpected <script> tags, event handlers, or javascript: URIs appearing in Charitable plugin form fields, campaign descriptions, or donation records.
WordPress access logs showing requests to Charitable plugin endpoints with suspicious query parameters containing HTML entities, encoded angle brackets, or JavaScript keywords.
Browser console errors or Content Security Policy (CSP) violations originating from pages that render Charitable plugin content.

Detection Strategies

Inventory WordPress deployments and identify installations running Charitable version 1.8.4.7 or earlier using plugin enumeration.
Inspect stored plugin data in the WordPress database for HTML or JavaScript payloads within Charitable-managed tables and metadata.
Deploy a web application firewall with rules that flag XSS payload patterns in requests targeting Charitable plugin URLs.

Monitoring Recommendations

Enable WordPress audit logging to track content changes made by low-privileged accounts within Charitable plugin interfaces.
Monitor for anomalous administrator session activity, including new user creation or plugin configuration changes following interaction with Charitable pages.
Alert on outbound requests from browser sessions to unfamiliar domains that could indicate exfiltration triggered by injected scripts.

How to Mitigate CVE-2025-30770

Immediate Actions Required

Update the Charitable plugin to a version later than 1.8.4.7 as soon as the vendor publishes a patched release.
Audit all WordPress user accounts and revoke unnecessary contributor, author, or editor privileges that could be leveraged to exploit the flaw.
Review Charitable campaign data and stored form submissions for existing injected payloads and sanitize any suspicious content.

Patch Information

Refer to the Patchstack Charitable XSS Vulnerability advisory for the latest patched version information. Administrators should apply the vendor-supplied update through the WordPress plugin manager as soon as it is available.

Workarounds

Deploy a Content Security Policy that restricts inline script execution and limits script sources to trusted origins.
Place the WordPress site behind a web application firewall with XSS protection rules enabled for Charitable plugin endpoints.
Temporarily disable the Charitable plugin on production sites if patching cannot be performed and the donation functionality is not business-critical.

bash

# Example Content Security Policy header for nginx
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self';" always;