CVE-2026-94159

HighCVSS 7.1

Published: 09/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Summary

The Total Donations plugin for WordPress (up to version 2.0.5) contains a Stored XSS vulnerability due to improper input neutralization during web page generation. An attacker can store malicious JavaScript that executes in the victim's browser each time the infected page is viewed.

Risk Assessment

An attacker can hijack multiple user sessions, steal data, or perform actions on their behalf. For administrators, this could lead to full site compromise.

Recommendation

Update the Total Donations plugin to the latest version (above 2.0.5). Until then, consider disabling the plugin or cleaning infected content.

Other vulnerabilities in Total Donations

See all

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KlbTheme Total Donations totaldonations allows Stored XSS.This issue affects Total Donations: from n/a through 2.0.5.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS