The Donation Thermometer WordPress plugin before version 2.3.0 fails to escape a colour value supplied in a shortcode attribute before incorporating it into a legend element’s attribute. This flaw allows any user with Contributor level or higher to insert arbitrary JavaScript event handlers that execute when a page containing the shortcode is rendered, leading to a stored cross‑site scripting vulnerability. The weakness is classified as CWE‑79 and permits the attacker to alter the behaviour of the website during visitor interaction, potentially compromising user session integrity and confidentiality.

The affected product is the Donation Thermometer plug‑in for WordPress, vulnerable in releases prior to 2.3.0. The vulnerability can impact any WordPress site that has installed the plug‑in and allows contributors or higher‑privileged users to edit posts or pages containing the relevant shortcode. No specific organizations or deployment types are mentioned in the CVE data, but nonprofit and fundraising sites that use the plug‑in may be within scope.

The CVSS score of 6.8 indicates a moderate severity. Exploitation requires user privileges of Contributor or higher, and the flaw is stored, not merely reflected. The EPSS score is less than 1 % and the flaw is not listed in the CISA KEV catalog, suggesting a low real‑world exploitation probability at present. Nevertheless, the presence of stored script execution constitutes a significant threat to user session integrity once the attacker is able to embed malicious payloads. Prompt patching is recommended to reduce risk, as no public exploit has been disclosed and the vulnerability remains in older releases.