CVE-2022-3128

What it actually does

The plugin fails to sanitize and escape stored settings, enabling persistent injection of script content that executes in browsers of site visitors even when the unfiltered_html capability is disabled.

Why it matters to the business

Administrators can unintentionally or maliciously embed executable code that affects all site visitors, increasing risk of session theft, defacement, or redirection on donation-themed sites using this plugin; the large number of WordPress sites amplifies potential reach.

How an attack unfolds

An attacker with administrator access crafts malicious HTML or JavaScript into plugin settings fields; the payload is saved without sanitization and later rendered for any user viewing the affected page, executing in their browser context.

How to fix it

Update the Donation Thermometer plugin to version 2.1.3 or later; restrict administrative access and review all existing plugin settings for unexpected content after upgrade.

How to confirm the fix worked

Confirm the installed plugin version is at least 2.1.3 via the WordPress admin dashboard or plugin file headers; inspect rendered pages and database option tables for absence of previously injected script markers.

Typical attack path

1. Obtain or compromise a WordPress administrator account on a site using the vulnerable plugin
2. Navigate to the plugin settings page and insert script payloads into unsanitized fields
3. Save the settings so the payload persists in the database
4. Wait for or lure visitors to view pages that render the stored settings
5. Browser executes the script in the visitor context, enabling theft or redirection

How to detect it

Review web server access logs and WordPress audit logs for unexpected changes to plugin options by admin users; inspect rendered HTML for inline scripts originating from plugin settings; check database options for suspicious script tags added around the publication date.

What your security team should do

• Immediately upgrade all instances of the plugin to 2.1.3 or newer
• Audit administrator accounts and limit plugin configuration privileges
• Scan site pages for unexpected script execution after remediation