WordPress Plugin Vulnerabilities

Charitable < 1.8.5.3 - Admin+ Stored XSS via Photo Field ALT Text

Description

The plugin does not sanitise and escape one of its campaign image text fields before outputting it in an HTML attribute, allowing users with a high-privilege campaign-management role to perform Stored Cross-Site Scripting attacks that execute on the front-end campaign page.

Proof of Concept

Affects Plugins

Plugin icon
charitable
Fixed in 1.8.5.3

References

CVE
CVE-2025-15675

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.5 (low)

Miscellaneous

Original Researcher
Krugov Artyom
Submitter
Krugov Aryom
Submitter website
https://research.cleantalk.org
Verified
Yes
WPVDB ID
19381d34-3942-4ba6-92a9-0290e1006da0

Timeline

Publicly Published
2026-07-23 (about 9 days ago)
Added
2026-07-23 (about 8 days ago)
Last Updated
2026-07-23 (about 8 days ago)

Other

Published
Title
Published
2026-02-26
Title
Responsive Zoom In/Out Slider WordPress Plugin <= 5.4.5 - Reflected Cross-Site Scripting
Published
2025-02-02
Title
Dreamstime Stock Photos < 4.2 - Reflected Cross-Site Scripting
Published
2025-07-15
Title
Robokassa payment gateway for Woocommerce <= 1.8.1 - Reflected Cross-Site Scripting
Published
2022-09-01
Title
Word Search Puzzles game <= 2.0.1 - Contributor+ Stored XSS
Published
2026-07-06
Title
Simply Schedule Appointments < 1.6.12.4 - Unauthenticated Stored XSS via Booking Customer Information