Charitable <1.8.5.3 Stored XSS via Photo Field ALT Text (CVE-2025-15675)

Vulnerability Overview Vulnerability Name: Charitable < 1.8.5.3 - Admin+ Stored XSS via Photo Field ALT Text Description: The plugin fails to sanitize and escape its active image text field before outputting it to an HTML attribute, allowing users with high-level active management roles to perform stored cross-site scripting attacks executed on the frontend activity page. CVE ID: CVE-2025-15675 Type: XSS (Cross-Site Scripting) OWASP Top 10: A7: Cross-Site Scripting (XSS) CWE: CWE-79 CVSS Score: 3.5 (Low) Affected Scope Affected Plugin: Charitable Fixed Version: 1.8.5.3 Remediation Fixed Version: Upgrade the Charitable plugin to version 1.8.5.3 or later. Timeline Public Disclosure Date: 2026-07-23 Date Added: 2026-07-23 Last Updated: 2026-07-23 Additional Information Original Researcher: Krugov Artyom Submitter: Krugov Artyom Submitter Website: https://research.cleantalk.org Verification Status: Yes WPVDB ID: 19381d34-3942-4ba6-92a9-0290e1006da0 Proof of Concept (POC) POC Code: No specific POC code was provided in the page; however, it states that the POC will be demonstrated on August 16, 2026, to give users time to update. Reference Links CVE Link: CVE-2025-15675 Classification Type: XSS OWASP Top 10: A7: Cross-Site Scripting (XSS) CWE: CWE-79 CVSS: 3.5 (Low) Miscellaneous Original Researcher: Krugov Artyom Submitter: Krugov Artyom Submitter Website: https://research.cleantalk.org Verification Status: Yes WPVDB ID: 19381d34-3942-4ba6-92a9-0290e1006da0 Timeline Public Disclosure Date: 2026-07-23 Date Added: 2026-07-23 Last Updated: 2026-07-23 Others Release Date: 2024-08-29 Title: LatePoint <= 4.9.91 - Authenticated (Subscriber+) Stored Cross-Site Scripting Release Date: 2025-04-09 Title: HTML5 Video Player with Playlist <= 2.50 - Reflected Cross-Site Scripting Release Date: 2024-05-30 Title: Premium Addons for Elementor < 4.10.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget Release Date: 2025-01-16 Title: Sandbox <= 0.4 - Reflected Cross-Site Scripting Release Date: 2024-01-19 Title: Formzu WP < 1.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting Summary This vulnerability involves a stored Cross-Site Scripting (XSS) issue in the Charitable plugin, affecting versions prior to 1.8.5.3. Users are advised to upgrade to the fixed version as soon as possible to mitigate the risk.

Goal Reached Thanks to every supporter — we hit 100%!

Charitable <1.8.5.3 Stored XSS via Photo Field ALT Text (CVE-2025-15675)