Improper neutralization of input during web page generation allows stored cross‑site scripting in the Double the Donation plugin. When an attacker submits data that includes malicious script, that data is later returned unescaped in donation pages, causing the browser to execute the script. Based on the description, it is inferred that this flaw can result in arbitrary script execution for any user who views the affected donation page, potentially leading to client‑side compromise or alteration of page content.

The vulnerability affects all releases of the WordPress Double the Donation plugin from vendor kanwei_doublethedonation that are version 2.0.0 or earlier.

The CVSS score of 5.9 indicates moderate severity. An EPSS score of less than 1% suggests a low probability of exploitation in the wild, and the risk is not listed in CISA's KEV catalog. Exploitation requires an attacker to insert malicious payloads into content handled by the plugin, which is then stored and subsequently rendered to visitors. No privileged access is required, but users who visit the compromised donation pages can be affected.