CVE-2025-5275: Charitable WordPress Plugin XSS Vulnerability

CVE-2025-5275 Overview

CVE-2025-5275 is a Stored Cross-Site Scripting (XSS) vulnerability in the Charitable – Donation Plugin for WordPress by WPBeginner. The flaw affects all plugin versions up to and including 1.8.6.1 and stems from insufficient input sanitization and output escaping in the privacy settings fields. Authenticated attackers with administrator-level access can inject arbitrary web scripts that execute when users visit affected pages. The vulnerability only impacts multi-site installations and installations where the unfiltered_html capability has been disabled. The issue was partially addressed in version 1.8.6.1 and fully remediated in 1.8.6.2.

Critical Impact
An authenticated administrator on a WordPress multi-site or unfiltered_html-restricted installation can inject persistent JavaScript that executes in any visitor's browser session.

Affected Products

WPBeginner Charitable Donation Plugin for WordPress versions ≤ 1.8.6.1
WordPress multi-site installations running the affected plugin
WordPress single-site installations where unfiltered_html has been disabled

Discovery Timeline

2025-06-26 - CVE-2025-5275 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5275

Vulnerability Analysis

The vulnerability is a Stored Cross-Site Scripting flaw classified under [CWE-79]. It resides in the privacy settings fields of the Charitable plugin's administrative interface. The plugin fails to sanitize input written into these fields and does not escape the same data on output. Attackers can persist arbitrary HTML and JavaScript payloads that render whenever an authenticated or unauthenticated visitor loads a page containing the injected content.

Exploitation requires administrator-level privileges and user interaction to trigger the stored payload. On standard WordPress single-site installations, administrators already possess the unfiltered_html capability, so the injection is not treated as a privilege boundary crossing. The vulnerability only becomes security-relevant on multi-site networks — where site administrators do not have unfiltered_html by default — or when the capability has been explicitly stripped.

Root Cause

The root cause is missing input sanitization on write operations and missing output escaping on render for values stored in the plugin's privacy settings. WordPress provides sanitization helpers such as sanitize_text_field() and escaping helpers such as esc_html() and esc_attr(), but the affected code path did not consistently apply them. The relevant template code referenced in the WordPress Charitable Checkbox Code illustrates the field-rendering pattern involved.

Attack Vector

The attack vector is network-based and requires an authenticated administrator account on a qualifying installation. The attacker submits a malicious payload through the plugin's privacy settings interface. The payload is stored in the WordPress database and later rendered without escaping. When a subsequent user visits an affected page, the browser executes the injected script in the context of the site origin, enabling session theft, forced administrative actions, and content defacement. Refer to the Wordfence Vulnerability Report for additional analysis.

Detection Methods for CVE-2025-5275

Indicators of Compromise

Unexpected <script>, <iframe>, or event-handler attributes (for example, onerror, onload) present in Charitable plugin privacy settings values stored in the wp_options table.
Outbound HTTP requests from visitor browsers to unfamiliar domains when rendering pages that display Charitable privacy content.
Administrator accounts created, modified, or elevated shortly after visits to pages containing Charitable-rendered content.

Detection Strategies

Audit the wp_options and plugin-specific database rows for HTML or JavaScript tokens within Charitable privacy settings fields.
Monitor WordPress admin activity logs for edits to Charitable settings by administrator accounts, particularly on multi-site networks.
Deploy Content Security Policy (CSP) reporting to surface inline script execution originating from pages that embed plugin content.

Monitoring Recommendations

Continuously inventory installed WordPress plugins and their versions, and alert on any Charitable installation at ≤ 1.8.6.1.
Log and review administrator authentication events on WordPress multi-site networks for anomalous session patterns.
Correlate web server access logs with unusual outbound requests from client browsers to identify script beaconing.

How to Mitigate CVE-2025-5275

Immediate Actions Required

Upgrade the Charitable plugin to version 1.8.6.2 or later on all WordPress sites.
Review and remove any suspicious HTML or JavaScript content stored in the plugin's privacy settings fields.
Rotate administrator credentials on multi-site networks where the affected version was installed.

Patch Information

WPBeginner partially fixed the issue in Charitable version 1.8.6.1 and fully fixed it in version 1.8.6.2. Site owners should update through the WordPress plugin management interface or via WP-CLI. Confirm the installed version is 1.8.6.2 or newer across every site in a multi-site network.

Workarounds

Restrict administrator access to trusted personnel only, particularly on WordPress multi-site networks where unfiltered_html is disabled by default.
Temporarily deactivate the Charitable plugin on affected sites until the patched version is deployed.
Enforce a strict Content Security Policy that blocks inline scripts to reduce the impact of stored XSS payloads.

bash

# Configuration example: update Charitable via WP-CLI across a multi-site network
wp plugin update charitable --network
wp plugin get charitable --field=version