Skip to content
Sign in
6.1 Medium

CVE-2023-6161 The WP Crowdfunding WordPress plugin before 2.1.9 does not sanitise and escape a parameter before outputting it back…

Description

The WP Crowdfunding WordPress plugin before 2.1.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Affected products and versions

Product Affected versions Fixed in
WP Crowdfunding 2.1 earliest → < 2.1.9 2.1.9

Other CVEs of WP Crowdfunding

The 6 CVEs of WP Crowdfunding →
CVE-2026-14858 The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details,… 4.3 Medium CVE-2026-14859 The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX… 4.3 Medium CVE-2026-14857 The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update… 4.3 Medium CVE-2023-6163 The WP Crowdfunding WordPress plugin before 2.1.10 does not sanitise and escape some of its settings, which could… 4.8 Medium
Track this CVE