CVE-2026-76063
Received Received - Intake

Stored XSS in FundEngine WordPress Donation Plugin

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: Wordfence

Description
The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfp_featured_video_url' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The REST endpoint used to submit the video URL has its permission_callback set to __return_true, meaning any authenticated user — including those with Subscriber-level access — can reach the vulnerable code path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-76063
EUVD
EUVD-2026-65276

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
fundengine donation_and_crowdfunding_platform to 1.8.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) issue in the FundEngine WordPress plugin. It allows authenticated attackers with subscriber-level access or higher to inject malicious scripts via the 'wfp_featured_video_url' parameter. The plugin fails to properly sanitize input and escape output, enabling script execution when users view infected pages. The REST endpoint lacks proper permission checks, allowing any authenticated user to exploit it.

Detection Guidance

Check WordPress sites using the FundEngine plugin for the vulnerable parameter 'wfp_featured_video_url' in versions up to 1.8.1. Inspect REST API calls to the endpoint handling video URLs with subscriber-level access.

Impact Analysis

An attacker could steal cookies, session tokens, or other sensitive data from users. They might redirect users to malicious sites, deface your website, or perform actions on behalf of users. Since it requires only subscriber-level access, the risk is higher for sites with open registration or many low-privilege users.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles. For HIPAA, it may expose protected health information if exploited. Both regulations require safeguarding user data, and this flaw could result in non-compliance, fines, or legal consequences if exploited.

Mitigation Strategies

Update the FundEngine plugin to the latest version beyond 1.8.1. If an update is unavailable, disable the plugin or restrict subscriber-level access to the vulnerable REST endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76063. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart