CVE-2026-92409

The Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour value taken from a shortcode attribute before using it in an attribute of the generated legend markup, allowing users with the Contributor role and above to inject arbitrary event handlers that execute when the page i...

CVE-2026-92409

The Donation Thermometer WordPress plugin before version 2.3.0 is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to escape a colour value retrieved from a shortcode attribute before it is used within an attribute of the generated legend markup . This allows ...

CVE-2026-92409 Donation Thermometer 2.2.9 - 2.2.11 - Contributor+ Stored XSS via Shortcode

The Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour value taken from a shortcode attribute before using it in an attribute of the generated legend markup, allowing users with the Contributor role and above to inject arbitrary event handlers that execute when the page i...

EUVD-2026-100863

The Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour value taken from a shortcode attribute before using it in an attribute of the generated legend markup, allowing users with the Contributor role and above to inject arbitrary event handlers that execute when the page i...

WordPress Donation Thermometer plugin < 2.3.0 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Philipp Doblhofer in WordPress Plugin Donation Thermometer versions 2.3.0...

CVE-2026-92409 Donation Thermometer 2.2.9 - 2.2.11 - Contributor+ Stored XSS via Shortcode

The Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour value taken from a shortcode attribute before using it in an attribute of the generated legend markup, allowing users with the Contributor role and above to inject arbitrary event handlers that execute when the page i...

PT-2026-113692

The Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour value taken from a shortcode attribute before using it in an attribute of the generated legend markup, allowing users with the Contributor role and above to inject arbitrary event handlers that execute when the page i...

EUVD-2025-210354

Unauthenticated Broken Access Control in Donation Thermometer = 2.2.7 versions...

CVE-2025-64636

Unauthenticated Broken Access Control in Donation Thermometer = 2.2.7 versions...

CVE-2025-64636 WordPress Donation Thermometer plugin <= 2.2.7 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Donation Thermometer = 2.2.7 versions...

CVE-2025-64636

Affected software : WordPress Donation Thermometer plugin (versions

CVE-2025-64636 WordPress Donation Thermometer plugin <= 2.2.7 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Donation Thermometer = 2.2.7 versions...

WordPress Donation Thermometer plugin <= 2.2.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin Donation Thermometer versions = 2.2.7...

PT-2026-52712

Unauthenticated Broken Access Control in Donation Thermometer = 2.2.7 versions...

CVE-2025-64636: Missing Authorization

Unauthenticated Broken Access Control in Donation Thermometer = 2.2.7 versions...

WordPress Donation Thermometer plugin cross-site scripting vulnerability

The WordPress Donation Thermometer plugin is a plugin for WordPress sites that visualizes the progress of donations by displaying a progress bar usually like a thermometer. The WordPress Donation Thermometer plugin suffers from a cross-site scripting vulnerability that stems from the application'...

CVE-2025-67550

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in rhewlif Donation Thermometer donation-thermometer allows Stored XSS.This issue affects Donation Thermometer: from n/a through = 2.2.6...

EUVD-2025-202096

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in rhewlif Donation Thermometer donation-thermometer allows Stored XSS.This issue affects Donation Thermometer: from n/a through = 2.2.6...

CVE-2025-67550

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in rhewlif Donation Thermometer donation-thermometer allows Stored XSS.This issue affects Donation Thermometer: from n/a through = 2.2.6...

CVE-2025-67550 WordPress Donation Thermometer plugin <= 2.2.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in rhewlif Donation Thermometer donation-thermometer allows Stored XSS.This issue affects Donation Thermometer: from n/a through = 2.2.6...