EUVD-2026-74624
GHSA-qj7q-4x68-8gg5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Admin must explicitly navigate to the attacker's profile via ?show_user_id= to trigger the stored payload, requiring UI:R rather than UI:N.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. An administrator viewing any user's profile via the ?show_user_id= parameter will render the attacker's stored payload in the admin's browser session, enabling cross-privilege script execution.
AnalysisAI
Stored Cross-Site Scripting in the WP Crowdfunding WordPress plugin (≤2.2.1, by Themeum) allows authenticated subscribers to inject persistent JavaScript via the first_name parameter in the plugin's user profile dashboard. When an administrator views the attacker's user profile via the ?show_user_id= URL parameter, the payload executes in the admin's browser session, enabling cross-privilege script execution from a subscriber-level account to an administrative context. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold at minimum a subscriber-level WordPress account on the target site; this means either user self-registration is enabled on the site (allowing external account creation) or the attacker has obtained credentials through other means. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.4 Medium score reflects the cross-privilege Scope:Changed nature of this stored XSS, where a subscriber-level account can execute scripts in an administrator's browser session. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | A patch commit is available in the WordPress.org plugin SVN repository at changeset 3677675 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3677675%40wp-crowdfunding&new=3677675%40wp-crowdfunding); upgrade to the version succeeding 2.2.1 once it is published to the WordPress plugin directory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wp Crowdfunding
View allWP Crowdfunding WordPress plugin before version 2.2.1 allows any subscriber-level authenticated user to create crowdfund
Insecure Direct Object Reference in WP Crowdfunding (WordPress plugin, all versions before 2.2.1) allows any authenticat
Broken object-level authorization in the WP Crowdfunding WordPress plugin before 2.2.1 allows any authenticated user - i
The WP Crowdfunding WordPress plugin before 2.1.9 does not sanitise and escape a parameter before outputting it back in
The WP Crowdfunding WordPress plugin before 2.1.8 does not sanitise and escape some of its settings, which could allow h
Insecure Direct Object References in WP Crowdfunding (Themeum) versions prior to 2.2.1 allow authenticated subscriber-le
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum WP Crowdfu
The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wp-crowdfunding/search blo
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low at
The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcf_donate short
The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check
Second-order SQL injection in the WP Crowdfunding WordPress plugin by Themeum (versions ≤2.2.1) enables authenticated sh
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today