Wp Fundraising Donation Vulnerabilities

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber...

CVSS:

4.3

Affected:

up to 1.8.1

Fixed in:

1.8.2

Disclosed:

Aug 24, 2026

CVE-2026-75930 on NVD →

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfp_featured_video_url' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...

CVSS:

6.4

Affected:

up to 1.8.1

Fixed in:

1.8.2

Disclosed:

Aug 24, 2026

CVE-2026-76063 on NVD →

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.9. This is due to deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the...

CVSS:

8.1

Affected:

up to 1.7.9

Fixed in:

1.8.0

Disclosed:

Aug 19, 2026

CVE-2026-73993 on NVD →

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.7.9 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable soft...

CVSS:

8.1

Affected:

up to 1.7.9

Fixed in:

1.8.0

Disclosed:

Aug 14, 2026

CVE-2026-32470 on NVD →

The FundEngine plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.7.8. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 1.7.8

Fixed in:

1.7.9

Disclosed:

Jul 27, 2026

CVE-2026-59560 on NVD →

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.7.6. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 1.7.6

Fixed in:

1.7.7

Disclosed:

Jul 8, 2026

CVE-2026-57406 on NVD →

The FundEngine plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.7.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This...

CVSS:

7.5

Affected:

up to 1.7.4

Fixed in:

1.7.5

Disclosed:

Aug 8, 2025

CVE-2025-48302 on NVD →

The WP Fundraising Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.3. This is due to missing or incorrect nonce validation on the wfp_donate_settings() function. This makes it possible for unauthenticated attackers to modify plugi...

CVSS:

4.3

Affected:

up to 1.7.3

Fixed in:

1.7.4

Disclosed:

May 7, 2025

CVE-2025-47459 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in XpeedStudio WP Fundraising Donation and Crowdfunding Platform allows Cross Site Request Forgery. This issue affects WP Fundraising Donation and Crowdfunding Platform: from n/a through 1.7.3.

Affected:

up to 1.7.4

Fixed in:

1.7.4

Disclosed:

May 7, 2025

CVE-2025-47459 on NVD →

[en] The FundEngine plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.0. This is due to the plugin not properly verifying user meta updated through the update_user_meta function. This makes it possible for authenticated attackers, with subscriber-level access and above...

Affected:

up to 1.7.1

Fixed in:

1.7.1

Disclosed:

Aug 1, 2024

CVE-2024-6698 on NVD →

The FundEngine plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.0. This is due to the plugin not properly verifying user meta updated through the update_user_meta function. This makes it possible for authenticated attackers, with subscriber-level access and above, to...

CVSS:

8.8

Affected:

up to 1.7.0

Fixed in:

1.7.1

Disclosed:

Jul 31, 2024

CVE-2024-6698 on NVD →

[en] Missing Authorization vulnerability in Wpmet WP Fundraising Donation and Crowdfunding Platform.This issue affects WP Fundraising Donation and Crowdfunding Platform: from n/a through 1.6.4.

Affected:

up to 1.7.0

Fixed in:

1.7.0

Disclosed:

Jun 11, 2024

CVE-2024-34758 on NVD →

The WP Fundraising Donation and Crowdfunding Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions surrounding donation modification in versions up to, and including, 1.6.4. This makes it possible for unauthenticated attackers to change p...

CVSS:

5.3

Affected:

up to 1.6.4

Fixed in:

1.7.0

Disclosed:

May 14, 2024

CVE-2024-34758 on NVD →

[en] The WP Fundraising Donation and Crowdfunding Platform WordPress plugin before 1.5.0 does not sanitise and escape a parameter before using it in a SQL statement via one of it's REST route, leading to an SQL injection exploitable by unauthenticated users

Affected:

up to 1.5.0

Fixed in:

1.5.0

Disclosed:

Jun 6, 2022

CVE-2022-0788 on NVD →

The WP Fundraising Donation and Crowdfunding Platform WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement via one of it's REST route, leading to an SQL injection exploitable by unauthenticated users

CVSS:

9.8

Affected:

up to 1.4.2

Fixed in:

1.5.0

Disclosed:

May 11, 2022

CVE-2022-0788 on NVD →

Affected:

up to 1.7.5

Fixed in:

1.7.5

CVE-2025-48302 on NVD →