CVE-2026-92409 Donation Thermometer 2.2.9 - 2.2.11 - Contributor+ Stored XSS via Shortcode
Contributors can inject malicious scripts via shortcode attributes in the Donation Thermometer plugin, leading to stored XSS attacks on viewers.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-92409?
CVE-2026-92409 is a medium-severity cross-site scripting vulnerability in Unknown Donation Thermometer, published on 14 Oct 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
The Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour value taken from a shortcode attribute before using it in an attribute of the generated legend markup, allowing users with the Contributor role and above to inject arbitrary event handlers that execute when the page is viewed.
Weakness: CWE-79
Which versions are affected by CVE-2026-92409?
How do I fix CVE-2026-92409?
No fix has been published for CVE-2026-92409 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-92409 being exploited?
There is no known exploitation of CVE-2026-92409 in the wild and no public exploit code.
Sources
Also known as GHSA-j5c7-8fqv-vrv8.