Stored Cross-Site Scripting Vulnerability in FundEngine Donation and Crowdfunding Platform for WordPress

CVE-2026-76063

What is CVE-2026-76063?

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress has a vulnerability that allows for Stored Cross-Site Scripting (XSS) due to inadequate input sanitization and output escaping on the 'wfp_featured_video_url' parameter. This weakness is present in all versions, up to and including 1.8.1. Authenticated attackers with subscriber-level access can exploit this vulnerability to inject malicious web scripts that execute when users access compromised pages, potentially leading to unauthorized actions or data theft. The vulnerability is exacerbated by the REST endpoint's permission callback being set to allow all authenticated users to access the vulnerable code path.

References