The Charitable WordPress plugin before version 1.8.5.3 fails to sanitize and escape the campaign image ALT text field before rendering it in an HTML attribute. This omission allows an attacker with a high‑privilege campaign‑management role to inject arbitrary JavaScript that is stored in the image metadata and subsequently executed in users’ browsers when they view the public campaign page. The effect is classic stored Cross‑Site Scripting, capable of stealing session cookies, executing malicious redirects, or defacing the website.

All installations of the Charitable plugin running a version earlier than 1.8.5.3 are vulnerable, regardless of the WordPress host. The flaw can be exploited only by users who have the capability to upload or edit campaign images, meaning that an attacker with a campaign‑management role can craft malicious ALT text and store it for victims to reach.

The EPSS score is below 1 %, indicating a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Nevertheless, because it is a stored XSS flaw that can execute arbitrary code in the context of the front‑end campaign page, it carries medium severity: any visitor to the affected page could have their session hijacked, their data accessed, or their browser redirected. Exploitation requires only that an authorized user submits a crafted payload; no additional conditions are needed. Its CVSS score is 4.8, reinforcing the medium severity assessment.