4.8
Moyenne
CVE-2023-6163 The WP Crowdfunding WordPress plugin before 2.1.10 does not sanitise and escape some of its settings, which could…
Description
The WP Crowdfunding WordPress plugin before 2.1.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| WP Crowdfunding 2.1 | premières → < 2.1.10 | 2.1.10 |
Autres CVE de WP Crowdfunding
Les 6 CVE de WP Crowdfunding →
CVE-2026-14858
The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details,…
4.3
Moyenne
CVE-2026-14859
The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX…
4.3
Moyenne
CVE-2026-14857
The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update…
4.3
Moyenne
CVE-2023-6161
The WP Crowdfunding WordPress plugin before 2.1.9 does not sanitise and escape a parameter before outputting it back…
6.1
Moyenne