CVE-2026-19945 in WP Crowdfunding Plugin
Summary
by MITRE • 09/09/2026
The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. An administrator viewing any user's profile via the ?show_user_id= parameter will render the attacker's stored payload in the admin's browser session, enabling cross-privilege script execution.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/09/2026
The WP Crowdfunding plugin for WordPress contains a critical security flaw identified as Stored Cross-Site Scripting within versions up to and including 2.2.1. This vulnerability stems from insufficient input sanitization and output escaping mechanisms when handling the first_name parameter during user profile updates or creation processes. Unlike reflected XSS attacks where malicious scripts are executed immediately via a crafted link, stored vulnerabilities persist by saving the injected payload into the application's database. Consequently, every time the compromised data is retrieved and rendered in a web page for legitimate users, the malicious script executes automatically within their browser context without requiring any further interaction from the victim beyond viewing the affected content.
The operational impact of this vulnerability is significant due to its ability to facilitate cross-privilege escalation through administrative interfaces. While the initial injection requires authenticated access at least at the subscriber level, the most severe consequences occur when an administrator views a user profile containing the malicious payload via the show_user_id parameter. Because administrators typically possess elevated privileges and perform sensitive operations within their session, executing arbitrary JavaScript in this context allows attackers to hijack administrative sessions. This can lead to complete compromise of the WordPress installation, including unauthorized modification of site settings, creation of new administrator accounts, defacement of the website, or theft of sensitive data stored on the server side through cookie stealing techniques.
From a technical classification perspective, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting and specifically falls under the Stored XSS subcategory where malicious scripts are permanently stored within target servers. In terms of adversary tactics, it maps to ATT&CK technique T1059 Command and Control via Browser Proxy or more broadly to initial access vectors involving compromised credentials if combined with other exploits, but primarily represents post-exploitation code execution capabilities that allow attackers to maintain persistence and escalate privileges within the web application environment. The lack of proper encoding when rendering user-supplied data in admin panels creates a direct path for script injection that bypasses standard browser security controls like Same-Origin Policy because the scripts originate from trusted domains.
Mitigation strategies must prioritize immediate patching by upgrading the WP Crowdfunding plugin to version 2.2.2 or later where these sanitization and escaping issues have been addressed. For organizations unable to upgrade immediately, implementing a Web Application Firewall with rules specifically targeting XSS payloads in user profile fields can provide temporary protection against exploitation attempts. Additionally, enforcing strict Content Security Policy headers that restrict script execution sources can mitigate the impact of any successfully injected scripts by preventing them from loading external resources or executing arbitrary code even if they manage to inject into the DOM. Regular security audits focusing on input validation and output encoding practices across all user-facing endpoints are essential to prevent similar vulnerabilities in future development cycles ensuring robust defense against persistent web-based attacks.