4.8
Medium
CVE-2023-6163 The WP Crowdfunding WordPress plugin before 2.1.10 does not sanitise and escape some of its settings, which could…
Description
The WP Crowdfunding WordPress plugin before 2.1.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WP Crowdfunding 2.1 | earliest → < 2.1.10 | 2.1.10 |
Other CVEs of WP Crowdfunding
The 6 CVEs of WP Crowdfunding →
CVE-2026-14858
The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details,…
4.3
Medium
CVE-2026-14859
The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX…
4.3
Medium
CVE-2026-14857
The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update…
4.3
Medium
CVE-2023-6161
The WP Crowdfunding WordPress plugin before 2.1.9 does not sanitise and escape a parameter before outputting it back…
6.1
Medium