CVE-2026-92409: Donation Thermometer 2.2.9 to before 2.3.0

Affected technology

Donation Thermometer · 2.2.9 to before 2.3.0
Vendor not specified by the source

Description’s affected range: before 2.3.0 does not escape a colour value taken from a shortcode attribute before using it in an attribute of the generated legend markup

Component: Not specified by the source

What an attacker can do

The source does not specify what an attacker can achieve.