CVE-2026-93885

7.2High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.2High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-79

Impact

Unauthenticated remote attackers can inject persistent malicious scripts to compromise visitors or administrators viewing affected pages. The attack requires only network access to the site's AJAX endpoint using a publicly exposed nonce.

Root cause

The cdbbc_payment_verify unauthenticated AJAX action fails to sanitize the data_object parameter and relies on a nonce that is leaked to anonymous users in page JavaScript.

Affected systems

Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin for WordPress up to and including 2.2.13

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Fix & remediation

Upgrade to a version newer than 2.2.13 once available, or deactivate and remove the plugin immediately if no patch is published.

shell

$ wp plugin deactivate cryptocurrency-donation-box

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

The Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via data_object Parameter in all versions up to, and including, 2.2.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by unauthenticated attackers because the cdbbc_payment_verify AJAX action is registered under wp_ajax_nopriv_ and its only authentication gate — a nonce check — is bypassable, as the cdbbc_donation_box nonce is publicly exposed to anonymous visitors via the wallets_data JavaScript object emitted by the [crypto-donation-box] shortcode.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-93885