CVE-2026-104394: Charitable Plugin XSS Vulnerability

CVE-2026-104394 Overview

CVE-2026-104394 is an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting the WordPress Charitable plugin in versions up to and including 1.8.12.3. The flaw allows unauthenticated attackers to inject malicious JavaScript that executes in a victim's browser when they interact with a crafted request or link. Successful exploitation requires user interaction and can lead to session theft, redirection, and arbitrary actions performed in the victim's context. The vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in administrator or donor browsers, enabling account takeover, defacement of donation pages, and manipulation of charitable transactions.

Affected Products

WordPress Charitable plugin versions <= 1.8.12.3
WordPress sites running the Charitable donation plugin
Any site hosting the vulnerable plugin version regardless of theme or configuration

Discovery Timeline

2026-10-06 - CVE-2026-104394 published to the National Vulnerability Database
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-104394

Vulnerability Analysis

The vulnerability stems from improper neutralization of user-supplied input before it is reflected in web page output generated by the Charitable plugin. An unauthenticated attacker can supply crafted input containing JavaScript payloads that the plugin renders without adequate sanitization or encoding. When a victim interacts with the malicious request, the payload executes within the victim's browser session on the affected WordPress site.

Because the scope is changed, the injected script can impact resources beyond the vulnerable component. This includes stealing session cookies, performing actions as an authenticated user, or pivoting to administrative functions when a site administrator visits the crafted link. Donation workflows that process financial data make the plugin a high-value target for attackers seeking to redirect funds or harvest donor information.

Root Cause

The root cause is the absence of proper output encoding and input sanitization on at least one input parameter processed by the Charitable plugin. User-controlled data flows into HTML context without being escaped using WordPress functions such as esc_html(), esc_attr(), or wp_kses(). This oversight permits HTML and JavaScript tags to be interpreted by the browser rather than rendered as literal text.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker crafts a URL or form submission containing a JavaScript payload targeting the vulnerable Charitable plugin endpoint. The attacker distributes the link through phishing emails, social media, or compromised sites. When a victim clicks the link, the injected payload executes in their browser under the origin of the WordPress site. See the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-104394

Indicators of Compromise

Unexpected <script> tags, event handlers (onerror=, onload=), or encoded JavaScript appearing in web server access logs for Charitable plugin endpoints
Outbound requests from administrator browsers to attacker-controlled domains following access to donation pages
Unauthorized changes to Charitable plugin configuration, donation forms, or user accounts
Spikes in traffic to Charitable endpoints with query strings containing URL-encoded HTML or JavaScript

Detection Strategies

Deploy a Web Application Firewall (WAF) with rules that detect XSS payload patterns targeting WordPress plugin parameters
Review web server and PHP error logs for suspicious parameter values submitted to Charitable plugin URLs
Monitor WordPress audit logs for anomalous administrator activity following plugin page visits
Correlate browser-side Content Security Policy (CSP) violation reports against Charitable plugin pages

Monitoring Recommendations

Enable WordPress activity logging to capture plugin configuration changes and user privilege modifications
Alert on HTTP requests to Charitable endpoints containing reserved characters such as <, >, ", or javascript:
Track outbound DNS queries from user workstations to newly registered or low-reputation domains after site visits
Review donation transaction records for unexpected recipient changes or redirected payment flows

How to Mitigate CVE-2026-104394

Immediate Actions Required

Update the Charitable plugin to a version later than 1.8.12.3 as soon as the vendor releases a patched release
Audit WordPress administrator accounts for unexpected activity and reset credentials where compromise is suspected
Deploy WAF rules that block common XSS payload patterns targeting WordPress plugins
Enforce a strict Content Security Policy that restricts inline scripts and limits trusted script sources

Patch Information

At the time of publication, consult the Patchstack Vulnerability Report for the latest patched version information. Administrators should subscribe to the Charitable plugin changelog in the WordPress plugin repository to receive update notifications. Apply updates through the WordPress administrative dashboard or via wp-cli after reviewing release notes.

Workarounds

Temporarily disable the Charitable plugin on affected sites until a patched version is installed
Restrict access to WordPress administrator pages using IP allowlisting or VPN enforcement
Train administrators and content editors to avoid clicking untrusted links while authenticated to the WordPress dashboard
Deploy browser-based script-blocking controls for sessions that administer the WordPress site

bash

# Update Charitable plugin via wp-cli once a patched release is available
wp plugin update charitable

# Temporarily deactivate the plugin as a workaround
wp plugin deactivate charitable