What is GHSA-j5c7-8fqv-vrv8?

GHSA-j5c7-8fqv-vrv8 is a security advisory published by GitHub Security Advisories with Medium severity. The Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour value taken from...

Which CVE IDs does GHSA-j5c7-8fqv-vrv8 cover?

GHSA-j5c7-8fqv-vrv8 covers the following CVE IDs: CVE-2026-92409. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-j5c7-8fqv-vrv8?

GHSA-j5c7-8fqv-vrv8 has a CVSS v3 base score of 6.8, published by GitHub Security Advisories.

GHSA-j5c7-8fqv-vrv8MediumCVSS 6.8

The Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour value taken from...

Vendor

GitHub Security Advisories

Published

October 14, 2026

Last Modified

October 15, 2026

🔗 CVE IDs covered (1)

CVE-2026-92409 →

📋 Description

The Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour value taken from a shortcode attribute before using it in an attribute of the generated legend markup, allowing users with the Contributor role and above to inject arbitrary event handlers that execute when the page is viewed.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-92409
https://wpscan.com/vulnerability/1c74b76e-fd6f-4dbc-aba1-f7de2444ee95
https://github.com/advisories/GHSA-j5c7-8fqv-vrv8