CVE-2026-76063 in FundEngine Plugin
Summary
by MITRE • 08/25/2026
The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfp_featured_video_url' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The REST endpoint used to submit the video URL has its permission_callback set to __return_true, meaning any authenticated user — including those with Subscriber-level access — can reach the vulnerable code path.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/25/2026
The FundEngine Donation and Crowdfunding Platform plugin for WordPress contains a critical security vulnerability affecting all versions up to and including 1.8.1. This flaw is classified as a Stored Cross-Site Scripting (XSS) issue, which poses significant risks to the integrity of web applications that rely on user-generated content or administrative inputs. The specific vector for this attack involves the wfp_featured_video_url parameter, where insufficient input sanitization and output escaping allow malicious actors to inject arbitrary JavaScript code into stored data fields within the application database.
The technical root cause lies in the inadequate validation mechanisms applied when processing video URL submissions through a REST endpoint. This endpoint is configured with its permission_callback set to __return_true, which effectively bypasses standard WordPress capability checks for this specific action. Consequently, any authenticated user, regardless of their role level including those with only Subscriber-level access, can interact with this code path and submit malicious payloads without requiring elevated privileges such as Administrator or Editor roles. This low barrier to entry significantly expands the attack surface, allowing even the least privileged users on a WordPress installation to exploit the vulnerability.
When an attacker successfully injects a script via the wfp_featured_video_url parameter, the payload is stored in the database and subsequently rendered when other users access pages containing this data. Unlike reflected XSS where the malicious code must be executed immediately through a crafted link, stored XSS persists on the server side. This means that every time a victim user views the affected page, their browser executes the injected script within the context of the vulnerable site's domain. This persistence amplifies the potential impact, as it does not require social engineering to trick users into clicking specific links; simply visiting normal pages can trigger the malicious code execution.
The operational impact of this vulnerability is severe and multifaceted. Attackers can use the executed scripts to steal session cookies or authentication tokens, thereby hijacking user sessions and potentially escalating privileges by impersonating administrators if they manage to capture an admin's credentials. Furthermore, attackers may redirect users to phishing sites designed to harvest sensitive information such as login details or financial data associated with donations. In more advanced scenarios, the injected script could be used to deface the website, load malware onto visitors' devices through drive-by downloads, or perform actions on behalf of the victim user without their knowledge or consent, undermining trust in the platform's security posture.
From a classification perspective, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting and specifically falls under Stored XSS variants where malicious content is saved to the target server. In terms of adversary tactics, it maps to ATT&CK technique T1059 Command and Scripting Interpreter for executing arbitrary code within the browser environment and potentially T1078 Valid Accounts if attackers leverage stolen credentials to perform further actions. The lack of proper input validation also reflects CWE-20 Improper Input Validation which is a common precursor to many web application vulnerabilities.
To mitigate this vulnerability, immediate action is required by upgrading the FundEngine plugin to version 1.8.2 or later where these issues have been addressed. Administrators should ensure that all plugins are kept up-to-date with security patches released by vendors. In addition to updating software, implementing a Web Application Firewall can provide an additional layer of defense by filtering out malicious requests before they reach the application logic. It is also advisable to enforce strict role-based access controls and review custom code or configurations for any endpoints that might have overly permissive permission callbacks similar to __return_true which bypass standard security checks. Regular security audits and penetration testing should be conducted to identify and remediate similar input validation weaknesses across the entire WordPress installation ecosystem.