Plugin icon

WP Crowdfunding

wp-crowdfunding

Vulnerabilities:

19

Last Updated:

September 2, 2026

Active Installs:

2000

Published
Title
Fixed in
CVSS
Published
2026-09-08
Title
WP Crowdfunding < 2.2.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' Parameter
Fixed in
Fixed in 2.2.2
CVSS
6.4 (medium)
Published
2026-09-08
Title
WP Crowdfunding < 2.2.2 - Authenticated (Shop Manager+) SQL Injection via 'wpneo_reward' Post Meta
Fixed in
Fixed in 2.2.2
CVSS
4.9 (medium)
Published
2026-08-14
Title
WP Crowdfunding < 2.2.1 - Unauthenticated Insecure Direct Object Reference
Fixed in
Fixed in 2.2.1
CVSS
5.3 (medium)
Published
2026-08-10
Title
WP Crowdfunding < 2.2.1 - Subscriber+ Order Data Disclosure via IDOR
Fixed in
Fixed in 2.2.1
CVSS
4.3 (medium)
Published
2026-08-10
Title
WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Update Modification via IDOR
Fixed in
Fixed in 2.2.1
CVSS
4.3 (medium)
Published
2026-08-10
Title
WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Creation via Missing Authorization
Fixed in
Fixed in 2.2.1
CVSS
4.3 (medium)
Published
2025-04-01
Title
WP Crowdfunding < 2.1.16 - Contributor+ Stored XSS
Fixed in
Fixed in 2.1.16
CVSS
5.9 (medium)
Published
2025-03-11
Title
WP Crowdfunding < 2.1.15 - Missing Authorization to Authenticated (Subscriber+) Post Content Download
Fixed in
Fixed in 2.1.15
CVSS
5.3 (medium)
Published
2024-12-12
Title
WP Crowdfunding < 2.1.13 - Missing Authorization to Authenticated (Subscriber+) WooCommerce Installation
Fixed in
Fixed in 2.1.13
CVSS
4.3 (medium)
Published
2024-12-12
Title
WP Crowdfunding < 2.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 2.1.16
CVSS
6.4 (medium)
Published
2024-10-25
Title
WP Crowdfunding < 2.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpcf_donate Shortcode
Fixed in
Fixed in 2.1.12
CVSS
6.4 (medium)
Published
2024-08-26
Title
WP Crowdfunding < 2.1.11 - Missing Authorization to Authenticated (Subscriber+) to Enable/Disable Addons
Fixed in
Fixed in 2.1.11
CVSS
4.3 (medium)
Published
2023-12-22
Title
WP Crowdfunding < 2.1.10 - Admin+ Stored XSS
Fixed in
Fixed in 2.1.10
CVSS
3.5 (low)
Published
2023-12-22
Title
WP Crowdfunding < 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 2.1.7
CVSS
6.4 (medium)
Published
2023-12-13
Title
WP Crowdfunding < 2.1.9 - Reflected XSS
Fixed in
Fixed in 2.1.9
CVSS
7.1 (high)
Published
2023-11-28
Title
WP Crowdfunding < 2.1.8 - Admin+ Stored XSS
Fixed in
Fixed in 2.1.8
CVSS
3.5 (low)
Published
2023-11-07
Title
WP Crowdfunding < 2.1.7 - Reflected XSS
Fixed in
Fixed in 2.1.7
CVSS
7.1 (high)
Published
2023-09-08
Title
WP Crowdfunding < 2.1.6 - Cross-Site Request Forgery
Fixed in
Fixed in 2.1.6
CVSS
4.3 (medium)
Published
2023-09-05
Title
WP Crowdfunding < 2.1.5 - Missing Authorization via settings_reset
Fixed in
Fixed in 2.1.5
CVSS
4.3 (medium)