CVE-2026-93885: WordPress Crypto Donation Box XSS Flaw

CVE-2026-93885 Overview

CVE-2026-93885 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin for WordPress. All versions up to and including 2.2.13 are affected. The flaw resides in the cdbbc_payment_verify AJAX action, which is registered under wp_ajax_nopriv_ and accepts the data_object parameter without sufficient input sanitization or output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when administrators or visitors view affected pages. The nonce intended to gate the action is publicly exposed through the wallets_data JavaScript object emitted by the [crypto-donation-box] shortcode, defeating the only authentication check.

Critical Impact
Unauthenticated attackers can store malicious JavaScript that executes in administrator browsers, enabling session theft, backend action abuse, and site takeover pivots.

Affected Products

Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin for WordPress
All versions through 2.2.13
WordPress sites rendering the [crypto-donation-box] shortcode on any publicly accessible page

Discovery Timeline

2026-10-14 - CVE-2026-93885 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-93885

Vulnerability Analysis

The vulnerability stems from improper handling of the data_object parameter in the plugin's payment verification handler at includes/cdbbc-payment-verify.php. Attacker-controlled values are persisted to the database and later rendered in the admin donations list table (admin/table/cdbbc-list-table.php) without encoding. When an administrator views the donations table, the injected payload executes in the admin session context.

Because the handler is registered via wp_ajax_nopriv_cdbbc_payment_verify, no authentication is required to reach it. The only gate is a WordPress nonce check against cdbbc_donation_box. That nonce is emitted into the page DOM through the wallets_data JavaScript object produced by the [crypto-donation-box] shortcode, making it readable by any anonymous visitor.

Root Cause

The root cause is a combination of two weaknesses: missing input sanitization on data_object on write and missing output escaping when rendering stored values. The nonce exposure in the shortcode output removes the practical barrier that wp_verify_nonce would otherwise provide, converting what appears to be an authenticated action into an effectively open endpoint.

Attack Vector

An attacker fetches any page containing the [crypto-donation-box] shortcode and reads the cdbbc_donation_box nonce from the embedded wallets_data object. The attacker then issues a POST request to admin-ajax.php targeting the cdbbc_payment_verify action with a crafted data_object payload containing JavaScript. The payload is stored and executes when any user, typically an administrator, loads the donations list view.

No verified public exploit code is referenced in the advisory. For code-level context, see the WordPress Payment Verification Code, the WordPress Shortcode Implementation Code, and the WordPress Plugin Admin Table Code.

Detection Methods for CVE-2026-93885

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php with action=cdbbc_payment_verify originating from unauthenticated sessions
data_object parameter values containing HTML tags, <script>, javascript:, event handlers (onerror, onload), or encoded script fragments
New or modified donation records in the plugin's database table containing script content
Unexpected outbound requests from administrator browsers immediately after viewing the plugin's admin donations list

Detection Strategies

Inspect web server and WAF logs for cdbbc_payment_verify AJAX calls from anonymous clients, correlating with payload content in POST bodies
Query the WordPress database for donation rows whose stored fields contain <, >, or JavaScript URI schemes
Monitor administrator browser telemetry for script execution on the plugin admin page URL path

Monitoring Recommendations

Enable file-integrity monitoring on the wp-content/plugins/cryptocurrency-donation-box/ directory
Alert on any admin-ajax.php action from the wp_ajax_nopriv_ namespace that writes to persistence
Review the Wordfence Vulnerability Analysis for additional signatures

How to Mitigate CVE-2026-93885

Immediate Actions Required

Deactivate the Cryptocurrency Donation Box plugin on any site running version 2.2.13 or earlier until a patched release is installed
Remove the [crypto-donation-box] shortcode from publicly accessible pages to stop nonce exposure
Audit stored donation records for script content and purge malicious entries before any administrator views the list table
Rotate administrator session cookies and credentials if admin pages were loaded while a payload could have been stored

Patch Information

No fixed version is listed in the NVD entry at the time of publication. Monitor the plugin's WordPress.org page and the Wordfence Vulnerability Analysis for a patched release and apply it as soon as available.

Workarounds

Block unauthenticated POST requests to admin-ajax.php where action=cdbbc_payment_verify using a WAF rule
Restrict access to pages containing the donation shortcode to authenticated users while awaiting a fix
Apply a Content Security Policy that disallows inline scripts on the WordPress admin interface to limit XSS payload execution

bash

# Example nginx rule to block the vulnerable AJAX action
location = /wp-admin/admin-ajax.php {
    if ($request_method = POST) {
        if ($request_body ~* "action=cdbbc_payment_verify") {
            return 403;
        }
    }
}