CVE-2025-57929: Double the Donation Plugin XSS Vulnerability

CVE-2025-57929 Overview

CVE-2025-57929 is a stored cross-site scripting (XSS) vulnerability in the Double the Donation WordPress plugin developed by kanwei. The flaw affects all versions up to and including 2.0.0 and stems from improper neutralization of input during web page generation [CWE-79]. An authenticated attacker with high privileges can inject persistent JavaScript payloads that execute in the browsers of users viewing the affected pages. Because the vulnerability crosses a security scope boundary, the injected script can impact users beyond the attacker's own privilege context.

Critical Impact

Attackers with high-privileged access can store malicious scripts that execute against other site users, leading to session theft, credential harvesting, and unauthorized administrative actions.

Affected Products

• Double the Donation WordPress plugin (double-the-donation)
• All versions from initial release through 2.0.0
• WordPress sites integrating the Double the Donation matching-gifts service

Discovery Timeline

• 2025-09-22 - CVE-2025-57929 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-57929

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the Double the Donation plugin. User-controlled input is written into the WordPress database and later rendered in a web page without adequate encoding or sanitization. When an administrator or site visitor loads the affected view, the browser interprets the stored payload as executable JavaScript rather than inert data.

Exploitation requires an authenticated user with elevated privileges to submit the malicious content. However, the payload executes against any user who subsequently accesses the rendered page, including lower-privileged accounts and unauthenticated visitors depending on where the content is displayed. This scope change enables lateral impact across trust boundaries within the WordPress site.

Attackers can use the injected script to hijack sessions, exfiltrate authentication cookies, perform actions on behalf of the victim, redirect users to attacker-controlled infrastructure, or stage secondary payloads such as phishing overlays.

Root Cause

The root cause is missing or insufficient output encoding when the plugin renders stored input into HTML contexts. Input flowing from plugin administration or configuration fields is not escaped using WordPress functions such as esc_html(), esc_attr(), or wp_kses() before being emitted to the DOM. See the Patchstack XSS Vulnerability Advisory for advisory-level detail.

Attack Vector

The attack is network-based and requires user interaction. A privileged attacker submits a crafted payload through a plugin field that stores the content in the WordPress database. When a victim loads the page rendering that content, the browser executes the script under the site's origin. No exploit code is publicly available at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

The vulnerability is described in prose only because no verified proof-of-concept code has been released. Refer to the vendor advisory for further technical context.

Detection Methods for CVE-2025-57929

Indicators of Compromise

• Unexpected <script>, onerror=, onload=, or javascript: strings stored in WordPress plugin option tables or post metadata related to double-the-donation.
• Outbound HTTP requests from administrator browsers to unfamiliar domains immediately after loading plugin-managed pages.
• New or modified WordPress administrator accounts created shortly after suspicious plugin configuration changes.

Detection Strategies

• Audit the wp_options, wp_postmeta, and plugin-specific tables for HTML or JavaScript syntax in fields that should contain plain text.
• Deploy Content Security Policy (CSP) reporting to surface inline script violations on pages rendered by the plugin.
• Review web server access logs for suspicious POST requests to plugin administration endpoints followed by anomalous GET traffic from other sessions.

Monitoring Recommendations

• Monitor WordPress audit logs for changes to Double the Donation plugin settings by administrator accounts.
• Alert on browser telemetry indicating script execution from plugin-rendered pages that contact external domains.
• Track privileged account activity for signs of session reuse or actions inconsistent with legitimate administrator workflows.

How to Mitigate CVE-2025-57929

Immediate Actions Required

• Restrict access to the Double the Donation plugin administration interface to a minimal set of trusted administrators.
• Review all stored plugin content for injected HTML or JavaScript and remove malicious payloads.
• Rotate credentials and invalidate active sessions for administrators who accessed the affected pages during the exposure window.

Patch Information

At the time of publication, the advisory identifies all versions up to and including 2.0.0 as affected. Site owners should consult the Patchstack XSS Vulnerability Advisory for the latest fixed version and apply the update through the WordPress plugin manager.

Workarounds

• Deactivate and remove the Double the Donation plugin until a patched version is installed if the plugin is not business-critical.
• Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
• Place the WordPress administration interface behind an authenticated reverse proxy or web application firewall with XSS filtering rules.

# Configuration example: strict CSP header via Apache to limit XSS impact
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"