The vulnerability resides in the Donation Thermometer WordPress plugin prior to version 2.3.0. An attacker with Contributor level or higher can supply a colour value in a shortcode attribute that the plugin uses unescaped in a legend element’s attribute. This allows arbitrary JavaScript event handlers to be injected and executed when visitors view the page, resulting in a stored cross‑site scripting flaw that could compromise the confidentiality, integrity, or availability of user sessions or application data. This is a CWE‑79 vulnerability.

The affected product is the Donation Thermometer plugin for WordPress, which is vulnerable in all releases before 2.3.0. Based on the description, it is inferred that the plugin may be installed on nonprofit and fundraising WordPress sites, but the CVE data does not explicitly state its prevalence.

Exploitability requires the presence of a contributor or higher role within the target site, giving the attacker the ability to edit content with the shortcode. Because the vulnerability is stored, remediation is an update; however, the EPSS score is below 1 % and the flaw is not listed in the CISA KEV catalog, suggesting low to moderate real‑world exploitation likelihood. The absence of a publicly disclosed exploit and low EPSS score imply that an immediate patch is recommended but that the overall risk remains moderate pending an update release.