CVE-2026-92409
Donation Thermometer 2.2.9 - 2.2.11 - Contributor+ Stored XSS via Shortcode
- State
- Published
- Severity
- 6.8 Medium
- Published
- Oct 14, 2026
- Updated
- Oct 15, 2026
- Reserved
- Sep 16, 2026
Description
The Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour value taken from a shortcode attribute before using it in an attribute of the generated legend markup, allowing users with the Contributor role and above to inject arbitrary event handlers that execute when the page is viewed.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.8 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H | CISA-ADP |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
Donation ThermometerUnknown |
|
References
- https://wpscan.com/vulnerability/1c74b76e-fd6f-4dbc-aba1-f7de2444ee95/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.