FundEngine CVE-2026-76063

Exploitation requires an authenticated WordPress account at Subscriber level or above - the lowest role assigned by default to users who self-register on a WordPress site. On donation and crowdfunding platforms, public registration for donors is typical and represents the primary risk amplifier for this flaw. The REST endpoint for wfp_featured_video_url must be reachable, which is the default state when the FundEngine plugin is active and no API endpoint filtering is applied. A victim user (who may be an administrator, editor, or anonymous visitor depending on campaign page visibility settings) must subsequently load the campaign page where the payload was submitted for the XSS to trigger. Limiting factors: WordPress installations with user registration disabled ('Anyone can register' unchecked) are not exploitable by external attackers unless they have an existing account through another channel; the attacker must submit the payload to a specific campaign's video URL field and cannot exploit arbitrary REST endpoints; server-side code execution is not possible - impact is bounded to the victim's browser session and the browsing context of users who view the injected campaign page.

The NVD CVSS 3.1 score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects a network-exploitable flaw with low attack complexity, low privilege requirement, and a scope change into victim browsers. The Scope:Changed metric is the most significant signal here: a successful attack transcends the plugin's own security context and compromises arbitrary visitor sessions, including site administrators. The PR:L rating is technically correct but understates practical risk on donation platforms, where public user registration for donors is the default deployment model - Subscriber accounts are trivially obtainable by any external party. The independent CVSS 3.1 assessment raises UI:R (victim must navigate to the injected page), which reduces the score modestly but does not change the priority tier for sites with open registration. No EPSS data was provided in source intelligence, so exploitation probability cannot be quantified. The vulnerability is not in the CISA KEV catalog, and no POC exploit code is referenced, though the vulnerable source lines are publicly exposed on the WordPress Trac browser, lowering the bar for independent discovery. For crowdfunding and nonprofit sites, where administrator and donor sessions are high-value targets, real-world risk exceeds what the mid-range CVSS score alone communicates.

An attacker registers a free donor account on a WordPress site running FundEngine - a plausible action on any public crowdfunding site - and submits a crafted video URL payload containing embedded JavaScript to the wfp_featured_video_url REST endpoint. The unsanitized payload is stored in the database and rendered without output escaping on the associated campaign page. Any subsequent visitor, including site administrators managing the campaign, automatically executes the attacker's script in their browser, enabling session token exfiltration, cookie theft, or redirection to attacker-controlled infrastructure. No public exploit code has been referenced at time of analysis, but the vulnerable source lines are publicly visible on the WordPress plugin Trac browser.