VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 13 known issues Latest disclosed Apr 01, 2025

WP Crowdfunding Vulnerabilities

Review known vulnerability records for the WordPress plugin WP Crowdfunding (`wp-crowdfunding`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2025-31892, CVE-2025-1508 and CVE-2024-11911, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
13
High or Critical
0
Patch Coverage
100%
Last Updated
Jun 05, 2025
Priority CVE Quick Links

Fast paths into WP Crowdfunding CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
12
CVE-2025-31892 Medium 2.1.16
CVE-2025-31892 WP Crowdfunding Stored Cross-Site Scripting

WP Crowdfunding <= 2.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting

CVE-2024-11910 Medium 2.1.16
CVE-2024-11910 WP Crowdfunding Stored Cross-Site Scripting

WP Crowdfunding <= 2.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting

CVE-2024-10117 Medium 2.1.12
CVE-2024-10117 WP Crowdfunding Stored Cross-Site Scripting

WP Crowdfunding <= 2.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpcf_donate Shortcode

CVE-2023-50859 Medium 2.1.7
CVE-2023-50859 WP Crowdfunding Stored Cross-Site Scripting

WP Crowdfunding <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

CVE-2023-6161 Medium 2.1.9
CVE-2023-6161 WP Crowdfunding Cross-Site Scripting

WP Crowdfunding <= 2.1.8 - Reflected Cross-Site Scripting

CVE-2023-47532 Medium 2.1.7
CVE-2023-47532 WP Crowdfunding Cross-Site Scripting

WP Crowdfunding <= 2.1.6 - Reflected Cross-Site Scripting via postid

CVE-2025-1508 Medium 2.1.15
CVE-2025-1508 WP Crowdfunding Vulnerability

WP Crowdfunding <= 2.1.14 - Missing Authorization to Authenticated (Subscriber+) Post Content Download

CVE-2023-6163 Medium 2.1.10
CVE-2023-6163 WP Crowdfunding Stored Cross-Site Scripting

WP Crowdfunding <= 2.1.9 - Authenticated (Admin+) Stored Cross-Site Scripting

Coverage Snapshot

What this page helps you verify fast

This hub clusters every indexed record for WP Crowdfunding so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
13 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
0 critical and 0 high severity findings.
Recent CVEs
CVE-2025-31892, CVE-2025-1508 and CVE-2024-11911
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

Known Vulnerabilities

Reports for WP Crowdfunding

Sorted by latest disclosure date so newly published issues surface first.

Plugin Medium Patched: Yes CVE-2025-31892
CVE-2025-31892: WP Crowdfunding <= 2.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting

The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.1.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above,...

Published
Apr 01, 2025
Patched Release
2.1.16
Affected Versions
Versions up to 2.1.15
Next Step
Update to 2.1.16 or newer if supported.
Open CVE-2025-31892 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-1508
CVE-2025-1508: WP Crowdfunding <= 2.1.14 - Missing Authorization to Authenticated (Subscriber+) Post Content Download

The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the download_data action in all versions up to, and including, 2.1.14. This makes it possible for authenticated attackers, with subscriber-level access and a...

Published
Mar 11, 2025
Patched Release
2.1.15
Affected Versions
Versions up to 2.1.14
Next Step
Update to 2.1.15 or newer if supported.
Open CVE-2025-1508 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-11911
CVE-2024-11911: WP Crowdfunding <= 2.1.12 - Missing Authorization to Authenticated (Subscriber+) WooCommerce Installation

The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the install_woocommerce_plugin() function action in all versions up to, and including, 2.1.12. This makes it possible for authenticated attackers, with...

Published
Dec 12, 2024
Patched Release
2.1.13
Affected Versions
Versions up to 2.1.12
Next Step
Update to 2.1.13 or newer if supported.
Open CVE-2024-11911 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-11910
CVE-2024-11910: WP Crowdfunding <= 2.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting

The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wp-crowdfunding/search block in all versions up to, and including, 2.1.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

Published
Dec 12, 2024
Patched Release
2.1.16
Affected Versions
Versions up to 2.1.15
Next Step
Update to 2.1.16 or newer if supported.
Open CVE-2024-11910 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-10117
CVE-2024-10117: WP Crowdfunding <= 2.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpcf_donate Shortcode

The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcf_donate shortcode in all versions up to, and including, 2.1.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

Published
Oct 25, 2024
Patched Release
2.1.12
Affected Versions
Versions up to 2.1.11
Next Step
Update to 2.1.12 or newer if supported.
Open CVE-2024-10117 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-43937
CVE-2024-43937: WP Crowdfunding <= 2.1.10 - Missing Authorization to Authenticated (Subscriber+) to Enable/Disable Addons

The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the addon_enable_disable() function in all versions up to, and including, 2.1.10. This makes it possible for authenticated attackers, with Subscriber-l...

Published
Aug 26, 2024
Patched Release
2.1.11
Affected Versions
Versions up to 2.1.10
Next Step
Update to 2.1.11 or newer if supported.
Open CVE-2024-43937 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-6163
CVE-2023-6163: WP Crowdfunding <= 2.1.9 - Authenticated (Admin+) Stored Cross-Site Scripting

The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-...

Published
Dec 22, 2023
Patched Release
2.1.10
Affected Versions
Versions up to 2.1.9
Next Step
Update to 2.1.10 or newer if supported.
Open CVE-2023-6163 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-50859
CVE-2023-50859: WP Crowdfunding <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level and above permis...

Published
Dec 22, 2023
Patched Release
2.1.7
Affected Versions
Versions up to 2.1.6
Next Step
Update to 2.1.7 or newer if supported.
Open CVE-2023-50859 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-6161
CVE-2023-6161: WP Crowdfunding <= 2.1.8 - Reflected Cross-Site Scripting

The WP Crowdfunding plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject ar...

Published
Dec 13, 2023
Patched Release
2.1.9
Affected Versions
Versions up to 2.1.8
Next Step
Update to 2.1.9 or newer if supported.
Open CVE-2023-6161 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-5757
CVE-2023-5757: WP Crowdfunding <= 2.1.7 - Authenticated (Admin+) Stored Cross-Site Scripting

The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-...

Published
Nov 28, 2023
Patched Release
2.1.8
Affected Versions
Versions up to 2.1.7
Next Step
Update to 2.1.8 or newer if supported.
Open CVE-2023-5757 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-47532
CVE-2023-47532: WP Crowdfunding <= 2.1.6 - Reflected Cross-Site Scripting via postid

The WP Crowdfunding plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘postid’ parameter in versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject a...

Published
Nov 07, 2023
Patched Release
2.1.7
Affected Versions
Versions up to 2.1.6
Next Step
Update to 2.1.7 or newer if supported.
Open CVE-2023-47532 Report Open CVE Reference
Plugin Medium Patched: Yes
WP Crowdfunding <= 2.1.5 - Cross-Site Request Forgery

The WP Crowdfunding plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1.5. This is due to missing or incorrect nonce validation on the settings_reset function. This makes it possible for unauthenticated attackers to reset plugin...

Published
Sep 08, 2023
Patched Release
2.1.6
Affected Versions
Versions up to 2.1.5
Next Step
Update to 2.1.6 or newer if supported.
Open Full Report