CVE-2026-19945: WP Crowdfunding <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' Parameter
The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. An administrator viewing any user's profile via the ?showuserid= parameter will render the attacker's stored payload in the admin's browser session, enabling cross-privilege script execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress WP Crowdfunding pluginto a version that resolves this vulnerability.Fixed in 2.2.1Patch WP Crowdfunding <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' Parameter
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with at least Subscriber-level access. The vulnerable plugin must be installed at version 2.2.1 or earlier.
What user interaction triggers the stored payload?
An administrator must view a user's profile using the ?show_user_id= parameter. When that profile is rendered, the stored script executes in the administrator's browser session.
What is the potential impact of successful exploitation?
The attacker can execute arbitrary web scripts in the context of an administrator viewing the affected profile. This enables cross-privilege script execution and may affect confidentiality and integrity in the administrator's session.