This vulnerability is a stored Cross‑Site Scripting (XSS) flaw in the Syed Balkhi Charitable plugin, where user‑supplied content is inserted into web pages without proper sanitization. As a result, an attacker who can inject malicious script into the plugin’s stored data can cause that script to execute in the browsers of any site visitor, enabling theft of session cookies, defacement, or redirection to malicious sites. The flaw maps to CWE‑79 and can compromise confidentiality, integrity, and the user experience of the entire WordPress site.

All installations of the Charitable WordPress plugin from version N/A through 1.8.5.1 are impacted. The plugin is distributed by Syed Balkhi and is commonly used to manage fundraising campaigns. No specific operating systems or PHP versions are listed, so any WordPress environment that includes the affected plugin version is at risk.

The CVSS score of 5.9 indicates a medium‑severity risk, while the EPSS score of less than 1% suggests a very low probability of exploitation in the wild at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves the plugin’s administrative interface or any form that allows the storage of user content; an attacker would need the ability to create or modify content in the plugin. Because the flaw constitutes a stored XSS, it requires a user to visit the affected page for exploitation to occur, making it a client‑side attack with limited server‑side impact.