WP Crowdfunding CVE-2026-42692

Exploitation targets the WP Crowdfunding plugin (Themeum) at versions 2.2.2 and earlier running on a WordPress site. No authentication is required (PR:N), but successful attack depends on user interaction (UI:R): a victim must be induced to click or load a crafted request, so the attacker needs a delivery vector such as phishing. The specific vulnerable parameter or feature is not described in the available sources. The primary limiting factor is the required victim interaction and the fact that impact is confined to the victim's browser session rather than the server itself; upgrading beyond 2.2.2 is the remediation path, though the exact fixed version is not specified in the provided data.

This is a moderate-severity reflected/unauthenticated Cross-Site Scripting flaw (CVSS 7.1, CWE-79) in the WP Crowdfunding WordPress plugin, reported by Patchstack and assigned a 'this_week' priority by the vuln.today decision framework. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) describes a network-reachable, low-complexity issue that needs no privileges (PR:N) but does require user interaction (UI:R), and the changed scope (S:C) reflects that injected script executes in the victim's browser context rather than only the vulnerable component. No EPSS score, no CISA KEV listing, and no confirmed exploit code are present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The 'this_week' label and Patchstack sourcing indicate this should be remediated promptly as part of routine patching, but the signals do not point to an emergency: the UI:R requirement and the typical limited impact of XSS (C:L/I:L/A:L) make this a real-but-not-urgent priority rather than a high-CVSS issue with disproportionately low real risk. EPSS is simply absent here (not low), so no probabilistic exploitation estimate can be stated.

An unauthenticated attacker crafts a malicious URL or request targeting the WP Crowdfunding plugin and lures a logged-in site visitor or administrator into clicking it; when the victim's browser loads the response, injected JavaScript executes in their session context. Because exploitation requires that user interaction (UI:R), the attacker must rely on phishing or social engineering, and no public exploit code has been identified at time of analysis.