CVE-2026-76063
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfp_featured_video_url' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The REST endpoint used to submit the video URL has its permission_callback set to __return_true, meaning any authenticated user — including those with Subscriber-level access — can reach the vulnerable code path.
Risk Assessment
The risk includes execution of malicious scripts in users' browsers, potentially leading to data theft, session hijacking, and damage to site reputation.
Recommendation
It is recommended to update the FundEngine plugin to the latest version and restrict access to the REST endpoint to authorized users only.
Other vulnerabilities in FundEngine
See all- CVE-2026-59560Medium
The FundEngine plugin version 1.7.8 and earlier contains a broken access control vulnerability exploitable by Subscriber-level users. An attacker can gain unauthorized access to functions or data.
- CVE-2026-73993Critical
Unauthenticated PHP Object Injection vulnerability in the FundEngine plugin. Affects versions up to 1.7.9.
- CVE-2026-32470Critical
An unauthenticated attacker can perform PHP Object Injection in FundEngine versions up to 1.7.9.
- CVE-2026-75930Medium
The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify arbitrary posts and pages — overwriting title and content, and seizing ownership by supplying an attacker-controlled post_author integer that bypasses wp_kses_post sanitization. The wp_rest nonce required by the handler is trivially obtainable by any logged-in user via /wp-admin/admin-ajax.php?action=rest-nonce and therefore does not constitute an authorization barrier.
- CVE-2026-57406Medium
The FundEngine WordPress plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 1.7.6.
Original NVD description (English source)
The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfp_featured_video_url' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The REST endpoint used to submit the video URL has its permission_callback set to __return_true, meaning any authenticated user — including those with Subscriber-level access — can reach the vulnerable code path.