CVE-2025-67550

MediumCVSS 6.5

Published: 09/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

9th percentile - higher than 9% of all known CVEs

Summary

The Donation Thermometer plugin for WordPress (up to version 2.2.6) has a Stored XSS vulnerability due to improper input neutralization during page generation. An attacker can store a malicious script that executes on every user visit.

Risk Assessment

Risk of persistent site infection, which can lead to user data theft, session hijacking, or malware distribution.

Recommendation

Update the plugin to the latest version if available, and thoroughly sanitize all input data before storing.

Other vulnerabilities in Donation Thermometer

CVE-2026-92409Medium
The Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour value taken from a shortcode attribute before using it in an attribute of the generated legend markup. This allows users with the Contributor role and above to inject arbitrary event handlers that execute when the page is viewed.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rhewlif Donation Thermometer donation-thermometer allows Stored XSS.This issue affects Donation Thermometer: from n/a through <= 2.2.6.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS