CVE-2026-76063: FundEngine <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wfp_featured_video_url' Parameter
The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfpfeaturedvideourl' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The REST endpoint used to submit the video URL has its permissioncallback set to returntrue, meaning any authenticated user — including those with Subscriber-level access — can reach the vulnerable code path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress FundEngine – Donation and Crowdfunding Platform pluginto a version that resolves this vulnerability.Fixed in 1.8.1 - Configuration
Update the REST endpoint’s permission_callback to restrict access so only trusted roles/users can submit the 'wfp_featured_video_url' value (the vulnerable condition is __return_true, which allows any authenticated user including Subscriber-level).
WordPress REST endpoint (for submitting the featured video URL) permission_callback = __return_true
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated WordPress user with Subscriber-level access or higher can reach the vulnerable REST endpoint. The endpoint's permission callback allows any authenticated user, rather than restricting access to a higher-privileged role.
What is required for exploitation?
An attacker needs a valid authenticated WordPress account and must submit a crafted value through the wfp_featured_video_url parameter. No user interaction is needed from the attacker, but the injected script runs when another user accesses the affected page.
Are sites affected if untrusted users can register as Subscribers?
Yes. Because Subscriber-level accounts can access the vulnerable code path, sites that permit self-registration or otherwise provide Subscriber accounts to untrusted users have a practical exposure path.