The vulnerability is an unauthenticated Cross‑Site Scripting (XSS) flaw that allows an attacker to inject malicious script into a Charitable plugin page, which is then rendered in the browser of any user who views the affected content. This weakness can lead to session hijacking, credential theft, data exfiltration, or defacement of the site, as the attacker’s script runs with the victim’s browser context. The flaw stems from improper sanitization of user‑controlled input in the WordPress Charitable plugin and is classified as CWE‑79.

WordPress sites running the Charitable plugin version 1.8.12.3 or earlier are affected. The vendor, Syed Balkhi, issues the plugin under the Charitable brand. Any installation of the affected versions, regardless of WordPress core or theme, is susceptible.

The CVSS score of 7.1 indicates a high risk severity. An EPSS score of <1% indicates a very low yet non‑zero probability that an attacker can exploit the flaw, and the lack of authentication required means any network‑reachable user could trigger it. The vulnerability is not listed in the CISA KEV catalog, indicating it has not yet been observed in the wild. Attackers can likely exploit the flaw by submitting crafted input through the plugin’s public interface or by visiting a malicious link that targets the vulnerable page. The ease of exploitation and absence of mitigation makes the risk notable for all sites using the vulnerable plugin version.