HIGH
blackworks1
CVE published 2026-10-14
CVE-2026-93885
The Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data_object parameter in versions up to and including 2.2.13. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts into pages, which will execute when a user accesses an injected page. The vulnerability exists because the cdbbc_payment_verify [truncated]