WordPress FundEngine Stored XSS Vulnerability (CVE-2026-76063) Advisory

Vulnerability Overview Vulnerability Name: FundEngine <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wfp_featured_video_url' Parameter CVE ID: CVE-2026-76063 CVSS Score: 6.4 (Medium) Publication Date: August 24, 2026 Last Updated: August 25, 2026 Researcher: Wordfence PRISM - Wordfence Impact Affected Versions: FundEngine <= 1.8.1 Vulnerability Type: Stored Cross-Site Scripting (Stored XSS) Description: The FundEngine Donation and Crowdfunding Platform plugin contains a stored cross-site scripting (XSS) vulnerability in versions 1.8.1 and earlier. Due to insufficient input validation and output escaping, attackers can inject malicious scripts that are executed when users visit pages containing the injected script. The REST endpoint used to submit the video URL has its capability callback set to , meaning any authenticated user (including those at the Subscriber level and above) can exploit this vulnerability. Remediation Fixed Version: Update to version 1.8.2 or later Patch Status: Fixed Additional Information References: - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org Recent Vulnerabilities FundEngine <= 1.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via campaign_post Parameter - CVE ID: CVE-2026-75930 - CVSS Score: 4.3 - Researcher: Wordfence PRISM - Publication Date: August 24, 2026 FundEngine - Donation and Crowdfunding Platform <= 1.7.9 - Unauthenticated PHP Object Injection - CVE ID: CVE-2026-73993 - CVSS Score: 8.1 - Researcher: TaySec - Publication Date: August 19, 2026 FundEngine - Donation and Crowdfunding Platform <= 1.7.9 - Unauthenticated PHP Object Injection - CVE ID: CVE-2026-32470 - CVSS Score: 8.1 - Researcher: daro - Publication Date: August 14, 2026 FundEngine <= 1.7.8 - Missing Authorization - CVE ID: CVE-2026-59560 - CVSS Score: 4.3 - Researcher: Septio Noerdiansyah - Publication Date: July 27, 2026 FundEngine - Donation and Crowdfunding Platform <= 1.7.6 - Missing Authorization - CVE ID: CVE-2026-57406 - CVSS Score: 5.3 - Researcher: Peng Zhou - Publication Date: August 6, 2026 FundEngine <= 1.7.4 - Authenticated (Subscriber+) Local File Inclusion - CVE ID: CVE-2025-48302 - CVSS Score: 7.5 - Researcher: Peter Thaleikis - Publication Date: August 8, 2025 WP Fundraising Donation and Crowdfunding Platform <= 1.7.3 - Cross-Site Request Forgery - CVE ID: CVE-2025-47459 - CVSS Score: 4.3 - Researcher: Nguyen Xuan Chien - Publication Date: July 5, 2025 FundEngine - Donation and Crowdfunding Platform <= 1.7.0 - Authenticated (Subscriber+) Privilege Escalation - CVE ID: CVE-2024-6698 - CVSS Score: 8.8 - Researcher: Thanh-Nam Tran - Publication Date: July 31, 2024 WP Fundraising Donation and Crowdfunding Platform <= 1.6.4 - Missing Authorization - CVE ID: CVE-2024-34758 - CVSS Score: 5.3 - Researcher: Peng Zhou - Publication Date: May 14, 2024 WP Fundraising Donation and Crowdfunding Platform <= 1.4.2 - Unauthenticated SQL Injection - CVE ID: CVE-2022-0798 - CVSS Score: 9.8 - Researcher: cydave - Publication Date: May 11, 2022 Summary This page details several security vulnerabilities in the FundEngine plugin, including stored cross-site scripting, arbitrary post modification, PHP object injection, local file inclusion, cross-site request forgery, privilege escalation, and SQL injection. It is recommended that users update to the latest version as soon as possible to address these vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress FundEngine Stored XSS Vulnerability (CVE-2026-76063) Advisory

More from this source