EUVD-2026-65276
GHSA-wjmx-c7qh-wc8h
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Victim must navigate to the injected campaign page (UI:R); Subscriber account required (PR:L); scope changes to victim browser context (S:C); no availability impact applies.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The FundEngine - Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfp_featured_video_url' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The REST endpoint used to submit the video URL has its permission_callback set to __return_true, meaning any authenticated user - including those with Subscriber-level access - can reach the vulnerable code path.
AnalysisAI
Stored Cross-Site Scripting in the FundEngine WordPress plugin (versions up to and including 1.8.1) allows any authenticated user with at minimum Subscriber-level access to inject persistent malicious scripts via the wfp_featured_video_url parameter. The REST endpoint that processes this input has its permission_callback hardcoded to __return_true, effectively bypassing WordPress role-based access controls and exposing the vulnerable code path to the lowest-privilege registered user. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress account at Subscriber level or above - the lowest role assigned by default to users who self-register on a WordPress site. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects a network-exploitable flaw with low attack complexity, low privilege requirement, and a scope change into victim browsers. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a free donor account on a WordPress site running FundEngine - a plausible action on any public crowdfunding site - and submits a crafted video URL payload containing embedded JavaScript to the `wfp_featured_video_url` REST endpoint. The unsanitized payload is stored in the database and rendered without output escaping on the associated campaign page. … |
| Remediation | Upstream fix available (WordPress plugin Trac changeset 3656562 at https://plugins.trac.wordpress.org/changeset?reponame=&old=3656562%40wp-fundraising-donation&new=3656562%40wp-fundraising-donation); however, the exact patched release version number is not confirmed in available data - verify the current version in the WordPress Plugin Repository and upgrade to any release later than 1.8.1 once available. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today