Stored Cross-Site Scripting Vulnerability in WP Crowdfunding Plugin

CVE-2024-11910

Summary

The WP Crowdfunding plugin for WordPress is affected by a vulnerability that enables stored cross-site scripting (XSS) due to insufficient sanitization of input and inadequate escaping of output within the wp-crowdfunding/search block. This vulnerability allows authenticated attackers, particularly those with Contributor-level access or higher, to embed arbitrary web scripts into pages. Such scripts execute in the context of the user's session when they access the compromised pages. As a result, this could lead to unauthorized actions, data exposure, and a compromised user experience.

References