WP Crowdfunding CVE-2026-19945

Exploitation requires the attacker to hold at minimum a subscriber-level WordPress account on the target site; this means either user self-registration is enabled on the site (allowing external account creation) or the attacker has obtained credentials through other means. The payload is stored server-side but is only triggered when an administrator explicitly navigates to the attacker's user profile using the ?show_user_id= URL parameter - the attack cannot be forced remotely without that admin action. The WP Crowdfunding plugin must be installed, active, and version 2.2.1 or earlier. Exploitation is meaningfully limited by the requirement for admin interaction: the attacker cannot self-trigger execution and must rely on an admin organically visiting the profile view.

The CVSS 6.4 Medium score reflects the cross-privilege Scope:Changed nature of this stored XSS, where a subscriber-level account can execute scripts in an administrator's browser session. EPSS data was not provided, and this CVE is absent from CISA KEV, indicating no confirmed active exploitation at time of analysis. No public exploit code has been identified. Real-world risk depends on two conditions: whether attacker-controlled subscriber accounts can be created (user self-registration enabled) and whether site administrators regularly inspect user profiles using the ?show_user_id= parameter. The provided CVSS vector uses UI:N, but the description explicitly requires an administrator to actively navigate to the injected profile - UI:R is more accurate and would reduce the base score to approximately 5.4; this discrepancy should be verified against the Wordfence advisory. If UI:R is correct, the real-world priority is somewhat lower than the stated score implies, as exploitation is not fully automated end-to-end.

An attacker registers a subscriber account on a WordPress site running WP Crowdfunding ≤2.2.1, then submits a JavaScript payload in the first_name field via the plugin's user profile dashboard. When a site administrator reviews the attacker's account by navigating to ?show_user_id=<attacker_id>, the stored script executes in the admin's authenticated browser session, enabling session token exfiltration, rogue admin account creation, or other administrative actions on the WordPress site.