CVE-2025-15675— Charitable < 1.8.5.3 - Admin+ Stored XSS via Photo Field ALT Text
Quick assessment
Affected
Unknown Charitable
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
wpbeginner charitable是wpbeginner公司开源的一个慈善捐赠管理插件。 wpbeginner charitable 1.8.5.3之前版本存在跨站脚本漏洞，该漏洞源于未清理和转义活动图片文本字段并将其输出到HTML属性中，可能导致具有高权限活动管理角色的用户执行存储型跨站脚本攻击，影响前端活动页面。
Possible ATT&CK Techniques 1 AI
T1059.007 · JavaScriptAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Charitable | < 1.8.5.3 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-15675
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Charitable < 1.8.5.3 - Admin+ Stored XSS via Photo Field ALT Text
Source: CVE Program / CVE List V5
Vulnerability Description
The Charitable WordPress plugin before 1.8.5.3 does not sanitise and escape one of its campaign image text fields before outputting it in an HTML attribute, allowing users with a high-privilege campaign-management role to perform Stored Cross-Site Scripting attacks that execute on the front-end campaign page.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
wpbeginner charitable 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
wpbeginner charitable是wpbeginner公司开源的一个慈善捐赠管理插件。 wpbeginner charitable 1.8.5.3之前版本存在跨站脚本漏洞，该漏洞源于未清理和转义活动图片文本字段并将其输出到HTML属性中，可能导致具有高权限活动管理角色的用户执行存储型跨站脚本攻击，影响前端活动页面。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Charitable | 0 ~ 1.8.5.3 | - |
|
II. Public POCs for CVE-2025-15675
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-15675
请登录查看更多情报信息。
Vendor Advisories for CVE-2025-15675 (1)
-
🔗 Charitable < 1.8.5.3 – Admin+ Stored XSS via Photo Field ALT Text | CVE 2025-15675 | Plugin Vulnerabilities Read full article exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-08-02 · 27 CVEs total
| CVE-2026-14817 | Element Pack Elementor Addons < 8.7.13 - Contributor+ DOM-Based Stored XSS via uikit Data | |
| CVE-2026-14864 | JetEngine < 3.8.12 - Contributor+ Stored XSS via jet_engine Shortcode | |
| CVE-2026-14920 | AcyMailing < 10.11.1 - Unauthenticated SQL Injection via subscription[] Parameter | |
| CVE-2026-14841 | King Addons for Elementor < 51.1.76 - Reflected XSS via Posts Grid Widget | |
| CVE-2026-14938 | FluentBoards < 1.95.3 - Subscriber+ Cross-Board Task Disclosure via IDOR | |
| CVE-2026-15151 | Five Star Restaurant Reservations < 2.7.23 - Booking Manager+ Missing Authorization via rt | |
| CVE-2026-15206 | SMS Alert Order Notifications – WooCommerce < 3.9.8 - Unauthenticated Account Takeover via | |
| CVE-2026-16256 | Pouco Import Users <= 1.0.0 - Unauthenticated Privilege Escalation | |
| CVE-2026-15248 | Meta Box < 5.13.1 - Contributor+ Arbitrary Attachment Deletion via IDOR | |
| CVE-2026-15939 | Simple Restrict < 1.2.9 - Contributor+ Restricted Content Disclosure via REST API | |
| CVE-2026-15241 | ChatBot for eCommerce – WoowBot < 4.8.4 - Unauthenticated Gemini API Key Abuse via qcld_ge | |
| CVE-2026-15385 | RT Mega Menu < 1.5.2 - Subscriber+ Stored XSS via Menu Item CSS | |
| CVE-2026-12586 | Lenxel WP <= 1.0.31 - Unauthenticated Account Takeover via Arbitrary Password Reset | |
| CVE-2026-15236 | Gallery for Google Photos < 1.2.1 - Unauthenticated Google OAuth Token Disclosure | |
| CVE-2026-11872 | Clever Mega Menu for Visual Composer <= 1.0.1 - Subscriber+ Menu Item Meta Update via save | |
| CVE-2026-16042 | LWS Optimize < 3.4 - Subscriber+ Cache Deletion | |
| CVE-2026-16285 | WooCommerce Product Attachment < 2.3.3 - Unauthenticated Arbitrary Media Download | |
| CVE-2026-16291 | ProfileGrid < 5.9.9.8 - Subscriber+ Arbitrary Notification Deletion via IDOR | |
| CVE-2026-16261 | Huge IT Login <= 1.0.4 - Unauthenticated Account Takeover | |
| CVE-2026-16273 | Narrative Publisher <= 1.0.7 - Contributor+ Stored XSS via narrative_post_script Post Meta |
Showing top 20 of 27 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Charitable
-
CVE-2026-16650
Charitable < 1.8.12 - Unauthenticated Donation Payment-Statu -
CVE-2026-73994
WordPress Charitable plugin <= 1.8.11.3 - Broken Access Cont -
CVE-2025-47520
WordPress Charitable plugin <= 1.8.5.1 - Cross Site Scriptin -
CVE-2025-30770
WordPress Charitable plugin <= 1.8.4.7 - Cross Site Scriptin -
CVE-2024-37506
WordPress Donation Forms by Charitable plugin <= 1.8.1.7 - B
Same vendor: Unknown
-
CVE-2026-78572
Kalles Addons <= 1.0.6 - Unauthenticated PHP Object Injectio -
CVE-2026-77115
Brave Popup Builder < 0.8.6 - Unauthenticated Reflected XSS -
CVE-2026-77116
Brave Popup Builder < 0.8.6 - Subscriber+ Unpublished Popup -
CVE-2026-77003
Content Mask 1.8.0 - 1.8.5.4 - Contributor Publish Capabilit -
CVE-2026-14853
WooCommerce Bookings < 3.9.0 - Subscriber+ Draft Bookable Pr
V. Comments for CVE-2025-15675
No comments yet