CVE-2025-57929

MediumCVSS 5.9

Published: 22/09/2025(UTC)Updated: 30/09/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

14th percentile - higher than 14% of all known CVEs

Summary

The Double the Donation plugin has a Stored XSS vulnerability due to improper input neutralization during web page generation. This affects versions up to and including 2.0.0.

Risk Assessment

An attacker can store malicious scripts that execute when the page is accessed, potentially leading to data theft or session hijacking.

Recommendation

Update the Double the Donation plugin to a version that includes the fix.

Other vulnerabilities in Double the Donation

CVE-2025-12020Medium
The Double the Donation plugin for WordPress is vulnerable to Stored Cross-Site Scripting in admin settings up to version 3.0.0. This is due to insufficient input sanitization and output escaping. Authenticated attackers with administrator-level permissions can inject arbitrary web scripts that execute when a user accesses an injected page.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kanwei_doublethedonation Double the Donation double-the-donation allows Stored XSS.This issue affects Double the Donation: from n/a through <= 2.0.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS