CVE-2026-19945

Deferred Deferred - Pending Action

Stored XSS in WP Crowdfunding WordPress Plugin

Publication date: 2026-09-09

Last updated on: 2026-09-09

Assigner: Wordfence

Description

The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. An administrator viewing any user's profile via the ?show_user_id= parameter will render the attacker's stored payload in the admin's browser session, enabling cross-privilege script execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-09

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-19945

EUVD

EUVD-2026-74624

Affected Vendors & Products

Vendor	Product	Version / Range
wp_crowdfunding	wp_crowdfunding	to 2.2.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

The WP Crowdfunding plugin for WordPress has a stored Cross-Site Scripting (XSS) vulnerability in the 'first_name' parameter. This flaw exists in versions up to 2.2.1 due to insufficient input sanitization and output escaping. Attackers with subscriber-level access or higher can inject malicious scripts into user profiles. When an administrator views a user's profile, the injected script executes in the admin's browser, potentially allowing further attacks.

Detection Guidance

Check for the WP Crowdfunding plugin versions up to 2.2.1. Inspect user profiles for unusual first_name parameter values containing scripts. Use WordPress admin panel to review stored user data for suspicious entries.

Impact Analysis

If you use the WP Crowdfunding plugin, an attacker with subscriber access could inject malicious scripts into your site. These scripts could steal sensitive data, such as admin credentials, when an administrator views the affected profile. It may also allow attackers to perform actions on your behalf or deface your website.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection. If exploited, it may result in data breaches, leading to legal penalties, reputational damage, and loss of trust. Organizations must address this flaw to maintain compliance with these regulations.

Mitigation Strategies

Update the WP Crowdfunding plugin to the latest version beyond 2.2.1. Sanitize user input fields like first_name. Implement strict output escaping in WordPress templates. Restrict subscriber-level access to sensitive functions.

Hi! I’m here to help you understand CVE-2026-19945. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70