The Raisely Donation Form plugin for WordPress contains a stored Cross‑Site Scripting vulnerability in all releases up to and including 1.1. Through the raisely_donation_form shortcode, insufficient input sanitization and output escaping allow an attacker who can authenticate with contributor‑level access or higher to embed arbitrary JavaScript. When a user views a page containing the injected shortcode, the script executes in the victim’s browser. This can lead to cookie theft, session hijacking, defacement, or phishing under the victim’s security context.

The vulnerability affects the "Raisely Donation Form" plugin distributed by Creative Freedom AU. Systems running any version of the plugin through 1.1 are impacted. The plugin is typically installed as a WordPress site component and can be accessed by site contributors and administrators.

The CVSS score of 6.4 flags medium severity, while the EPSS score of less than 1% indicates a low but non‑zero probability of exploitation. The weakness is not listed in the CISA KEV catalog. Exploitation requires authenticated access at the contributor level or higher, making it an implicit local attack vector. Because the attacker can run scripts in the context of any site visitor, the impact on confidentiality, integrity, or availability can be significant if the malicious code performs credential theft or defacement.