The vulnerability is a stored cross‑site scripting flaw within the privacy settings fields of the Charitable WordPress plugin. Because input sanitization and output escaping are insufficient, an attacker who has administrator privileges can embed arbitrary JavaScript. This weakness aligns with CWE-79, Cross‑Site Scripting. When an end‑user visits the affected page, the script executes in the user’s browser, potentially allowing data theft, session hijacking, or defacement. The flaw is confined to stored data and does not require user interaction beyond loading the page.

This issue affects installations of the Charitable plugin for WordPress (smub:Charitable) up to and including version 1.8.6.1. Only multi‑site WordPress environments that have the unfiltered_html feature disabled are vulnerable. The problem was partially addressed in 1.8.6.1 and fully resolved in 1.8.6.2.

The CVSS score of 4.4 indicates a medium impact, and the EPSS score of less than 1 % signals a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting no documented exploitation yet. Attackers must first authenticate as an administrator, then input malicious code into the privacy settings; there are no public exploits known, so the risk is moderate but low in terms of current exploitability.