This vulnerability is a DOM‑based Cross‑Site Scripting flaw caused by improper neutralization of input during web page rendering. The flaw allows an attacker to inject malicious scripts that execute in the victim’s browser, potentially leading to session hijacking, defacement or credential theft. The weakness is identified as CWE‑79, reflecting the failure to escape user‑controlled data before using it in a page context.

The issue affects the WordPress Charitable plugin from the earliest released version through 1.8.4.7. The plugin is distributed by Syed Balkhi and is commonly used on WordPress sites that embed fundraising or donation functionality.

With a CVSS score of 6.5, the exploit is considered moderate in severity. The EPSS score of less than 1% indicates a low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the victim to load a page containing malicious input, making it likely to be opportunistic and limited to users who interact with the affected plugin pages.