WordPress security by component

WP Crowdfunding

Plugin description

WP Crowdfunding creates crowdfunding campaigns with project goals, contribution forms, campaign pages, and funding management features in WordPress.

WP Crowdfunding (wp-crowdfunding) is a WordPress plugin with 20 published CVE records in this archive. The latest tracked vulnerability was published Oct 29, 2026; the highest published CVSS base score is 7.5.

Plugin slug: wp-crowdfunding

Latest vulnerability

CVE-2026-42692: WP Crowdfunding: Cross-site scripting

Unauthenticated Cross Site Scripting (XSS) in WP Crowdfunding <= 2.2.2 versions. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. Injected script executes in a victim browser when the affected output is rendered; the required viewer role is not disclosed. The CNA vector requires victim interaction; the specific interaction is not disclosed. The structured affected range is n/a through 2.2.2.

PublishedOct 29, 2026

Safe version guidanceSee mitigation notes

Published vulnerabilities for wp-crowdfunding
		Safe version
Oct 29, 2026	CVE-2026-42692 WP Crowdfunding: Cross-site scripting Unauthenticated Cross Site Scripting (XSS) in WP Crowdfunding <= 2.2.2 versions. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. Injected script executes in a victim browser when the affected output is rendered; the required viewer role is not disclosed. The CNA vector requires victim interaction; the specific interaction is not disclosed. The structured affected range is n/a through 2.2.2.	See mitigation notes	CVE7.1
Oct 29, 2026	CVE-2026-118083 WP Crowdfunding: Sensitive information exposure Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. The issue can disclose data to an unauthorized recipient, but the precise data and recipient are not specified. The structured affected range is n/a through 2.2.2.	See mitigation notes	CVE7.5
Sep 09, 2026	CVE-2026-19945 WP Crowdfunding permits subscriber scripts to run in an administrator's session WP Crowdfunding through 2.2.1 inadequately sanitizes and escapes first_name. A Subscriber or higher-privileged user can save script content that runs when the profile is rendered. An administrator viewing a user's profile through show_user_id can trigger the stored payload in the administrator's browser session.	2.2.2	CVE6.4
Sep 09, 2026	CVE-2026-19944 WP Crowdfunding executes stored reward metadata as SQL on campaign views WP Crowdfunding through 2.2.1 insufficiently escapes wpneo_reward post metadata and fails to prepare the resulting SQL safely. A Shop Manager or higher-privileged user can store malicious metadata through POST or PUT requests to /wp-json/wc/v3/products/{id}. Subsequent public campaign views that render the rewards sidebar execute the injected SQL, allowing sensitive database information to be extracted.	2.2.2	CVE4.9
Aug 18, 2026	CVE-2026-73189 WP Crowdfunding: Broken access control WP Crowdfunding is affected by broken access control. Exploitation requires an authenticated subscriber account. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a to < 2.2.1.	2.2.1	CVE6.5
Aug 12, 2026	CVE-2026-14859 WP Crowdfunding lets Subscribers create campaign posts WP Crowdfunding before 2.2.1 exposes wp_ajax_addfrontenddata, which calls Submit_Form::frontend_data_save() and accepts the campaign form. Although the request includes the wpcf_form_action_field nonce for action wpcf_form_action, the affected code does not enforce the campaign_form_submit capability before creating a product with wp_insert_post() and crowdfunding metadata. A Subscriber can therefore create campaign posts without permission. Version 2.2.1 adds the missing capability check.	2.2.1	CVE4.3
Aug 12, 2026	CVE-2026-14858 WP Crowdfunding exposes every WooCommerce order to Subscribers WP Crowdfunding before 2.2.1 exposes wp_ajax_wpcf_order_action. Dashboard::order_campaign_action() accepts the posted orderid, loads it with wc_get_order() and renders its details without verifying ownership. A Subscriber can iterate identifiers and read personal data from arbitrary WooCommerce orders. Version 2.2.1 permits managers and Administrators or requires that the current user own a crowdfunding product in the selected order.	2.2.1	CVE4.3
Aug 12, 2026	CVE-2026-14857 WP Crowdfunding lets Subscribers alter other users' campaigns WP Crowdfunding before 2.2.1 exposes wp_ajax_wpneo_update_status_save. update_status_save() accepts postid plus wpneo_prject_update_date_field, wpneo_prject_update_title_field and wpneo_prject_update_details_field, writes the resulting JSON to wpneo_campaign_updates and triggers wpcf_campaign_update_email for that campaign. Without an ownership check, a Subscriber can alter another user's campaign update history and email its backers. Version 2.2.1 adds ownership validation; the fixed class and predicate are not disclosed.	2.2.1	CVE4.3
Apr 01, 2025	CVE-2025-31892 WP Crowdfunding: Cross-site scripting WP Crowdfunding is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.5
Mar 12, 2025	CVE-2025-1508 WP Crowdfunding: A security weakness WP Crowdfunding is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3
Dec 13, 2024	CVE-2023-41870 WP Crowdfunding: A security weakness WP Crowdfunding is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE4.3
Dec 13, 2024	CVE-2024-11911 WP Crowdfunding: A security weakness WP Crowdfunding is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE4.3
Dec 13, 2024	CVE-2024-11910 WP Crowdfunding: Cross-site scripting WP Crowdfunding is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4
Nov 01, 2024	CVE-2024-43937 WP Crowdfunding: A security weakness WP Crowdfunding is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE6.4
Oct 26, 2024	CVE-2024-10117 WP Crowdfunding: Cross-site scripting WP Crowdfunding is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4
Jan 15, 2024	CVE-2023-6163 WP Crowdfunding: Cross-site scripting WP Crowdfunding is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE4.8
Jan 08, 2024	CVE-2023-6161 WP Crowdfunding: Cross-site scripting WP Crowdfunding is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.1
Dec 28, 2023	CVE-2023-50859 WP Crowdfunding: Cross-site scripting WP Crowdfunding is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.5
Dec 11, 2023	CVE-2023-5757 WP Crowdfunding: Cross-site scripting WP Crowdfunding is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVEPending
Nov 14, 2023	CVE-2023-47532 Wp Crowdfunding: Cross-site scripting Wp Crowdfunding is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.8

Data attribution: This product uses the NVD API but is not endorsed or certified by the NVD.

Vulnerability data licensing

CVE. Copyright © 1999–2026, The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CWE. Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy.

CVSS. CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and used by permission.

Source-record text is CVE/CNA content delivered through the NVD API. Fused summaries and remediation guidance are independently authored and are not attributed to NVD.

All other copyrights and trademarks are the property of their respective owners.

Full data sources, terms, and disclaimers