CVE-2025-15675

CVE-2025-15675 describes a Stored Cross-Site Scripting (XSS) vulnerability found in the Charitable WordPress plugin, affecting versions prior to 1.8.5.3. This flaw allows an attacker with a high-privilege campaign-management role to inject malicious JavaScript code. The vulnerability specifically resides in the campaign image text fields, such as the ALT Text field, where user input is not properly sanitized or escaped before being stored and rendered. When the affected campaign page is viewed, the injected malicious script executes on the front-end. This issue stems from insufficient input validation and output escaping mechanisms within the plugin's administrative interface.