Improper neutralization of user input in the KlbTheme Total Donations WordPress plugin leads to a stored cross‑site scripting flaw. The plugin fails to escape or sanitize content entered through the donation interface, allowing malicious scripts to be embedded in stored data that is later rendered on the web page. When a user views a donation record or page, the injected script executes in the visitor’s browser, potentially enabling theft of session cookies, defacement, phishing redirects, or other client‑side damage.

WordPress sites that have the KlbTheme Total Donations plugin installed at version 2.0.5 or earlier are impacted. No other vendors or products are listed as affected by this CVE.

The vulnerability is exploitable through the donation form, which accepts stored data that is displayed without sanitization. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, yet the CVSS score of 7.1 indicates a high‑severity risk. The likely attack vector is via the web interface: an attacker who can submit a donation record or modify existing entries can embed malicious code that will run in the browsers of any visitor to the relevant page. The attacker does not require elevated server privileges; remote exploitation is possible with access to the front‑end donation interface.