The Double the Donation – A workplace giving tool plugin for WordPress contains an insecure admin settings page that stores user input without proper sanitization or output escaping. When a user with administrator‑level permissions or higher modifies these settings, arbitrary JavaScript can be written to the database and rendered on any page that loads the injected content. The injected script runs in the context of visitors, potentially allowing session hijacking, data theft, or defacement. The vulnerability is an example of CWE‑79, classic stored cross‑site scripting.

All releases of Double the Donation up to and including version 3.0.0 are affected when the plugin is installed on a multisite WordPress network and the site configuration has unfiltered_html disabled. The issue persists across WordPress versions and any network that grants administrators the capability to edit the plugin settings through the dashboard.

The CVSS score of 4.9 places the flaw in the moderate severity range, while the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, further suggesting limited active exploitation. The attack path requires the attacker to be a logged‑in administrator or higher, which narrows the threat surface to privileged accounts. Nonetheless, because the payload executes in users’ browsers, any compromise of an administrator account could impact the entire multisite network.