CVE-2026-92409
The Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour value taken from a…
- Risk score
- 46/100
- CVSS
- 6.8 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 14 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour value taken from a shortcode attribute before using it in an attribute of the generated legend markup, allowing users with the Contributor role and above to inject arbitrary event handlers that execute when the page is viewed.
- Affected
- See advisory
- Fix
- Upgrade the product to 2.3.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.8 medium
References
Original description
The Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour value taken from a shortcode attribute before using it in an attribute of the generated legend markup, allowing users with the Contributor role and above to inject arbitrary event handlers that execute when the page is viewed.
Last activity 14 Oct 2026. Patch Forecast updates every hour.