Charitable <= 1.8.12.3 - Unauthenticated Reflected Cross-Site Scripting via Donate Button Shortcode
- ID
- WPSEC-2026-0172
- Plugin
- Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) (charitable)
- Affected
- from 1.8.2 before 1.8.13
- Remediation
- Update to 1.8.13 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Charitable on WPSec AttackSurface
- Fix released
- Published
Description
The Charitable plugin for WordPress is vulnerable to Cross-Site Scripting via the [charitable_donate_button] shortcode in versions 1.8.2 up to, and including, 1.8.12.3. The button variant placed its destination URL inside a single-quoted JavaScript string in an inline onclick handler, escaped only with esc_url(). esc_url() keeps entities such as ' and encodes a literal apostrophe as ', and the browser decodes both back into a quote inside the attribute. When the shortcode has neither a campaign nor a url attribute, the URL is built from the raw request query string. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that run when a victim follows a crafted link to such a page and clicks the donate button. Authenticated attackers with Contributor-level access and above can also store the same payload through the shortcode's url attribute.
References
- https://wpsec.com/vuln/WPSEC-2026-0172/
- https://plugins.svn.wordpress.org/charitable/tags/1.8.13/
- https://wordpress.org/plugins/charitable/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS