Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Charitable WordPress plugin before 1.8.5.3 does not sanitise and escape one of its campaign image text fields before outputting it in an HTML attribute, allowing users with a high-privilege campaign-management role to perform Stored Cross-Site Scripting attacks that execute on the front-end campaign page.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2025-15675 Stored Cross-Site Scripting in Charitable WordPress Plugin Before 1.8.5.3 https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-15675
Post summary
The advisory reports a stored XSS vulnerability in the Charitable WordPress Plugin (v < 1.8.5.3), labeled CVE-2025-15675, but provides no PoC, exploit, or mitigation details.
🚨*CVE* CVE-2025-15675 The Charitable WordPress plugin before 1.8.5.3 does not sanitise and escape one of its campaign image text fields before outputting it in an HTML attribute, allowing… https://www.cve.org/CVERecord?id=CVE-2025-15675 ----- Traducción: CVE-2025-15675 El … http://infoflow.cloud`
Post summary
The tweet announces CVE-2025-15675, a sanitization flaw in the Charitable WordPress plugin that could enable XSS via a campaign image text field; no PoC, exploit code, active exploitation, or patch is mentioned.
CVE-2025-15675 The Charitable WordPress plugin before 1.8.5.3 does not sanitise and escape one of its campaign image text fields before outputting it in an HTML attribute, allowing… https://www.cve.org/CVERecord?id=CVE-2025-15675
Post summary
The post announces a sanitisation flaw in the Charitable WordPress plugin, providing basic technical detail but no PoC, exploit, or patch information.