WP Crowdfunding

WP Crowdfunding has 19 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 19 are fixed as of September 2026. Their average CVSS score is 5.1, and the most serious one scores 6.4 out of 10. 2023 was the busiest year with 7 disclosures.

The most common weakness is Cross-Site Scripting, behind 9 of the records (47%). Other recurring categories include Missing Authorization, Authorization Bypass Through User-Controlled Key.

Every one of the 19 issues recorded for WP Crowdfunding has a vendor fix available, so running the current release closes all known holes.

14 independent researchers contributed these findings, most of them (2) reported by Abu Hurayra (HurayraIIT). WP Crowdfunding is installed on roughly 2,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

01234567891002.08.2016Today05.09.20234.3WP Crowdfunding <= 2.1.4 - Missing Authorization via settings_reset CVSS 4.3 · 05.09.202308.09.20234.3WP Crowdfunding <= 2.1.5 - Cross-Site Request Forgery CVSS 4.3 · 08.09.202307.11.20236.1WP Crowdfunding <= 2.1.6 - Reflected Cross-Site Scripting via postid CVSS 6.1 · 07.11.202328.11.20234.4WP Crowdfunding <= 2.1.7 - Authenticated (Admin+) Stored Cross-Site Scripting CVSS 4.4 · 28.11.202313.12.20236.1WP Crowdfunding <= 2.1.8 - Reflected Cross-Site Scripting CVSS 6.1 · 13.12.202322.12.20234.4WP Crowdfunding <= 2.1.9 - Authenticated (Admin+) Stored Cross-Site Scripting CVSS 4.4 · 22.12.20236.4WP Crowdfunding <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 22.12.202326.08.20244.3WP Crowdfunding <= 2.1.10 - Missing Authorization to Authenticated (Subscriber+) to Enable/Disable Addons CVSS 4.3 · 26.08.202425.10.20246.4WP Crowdfunding <= 2.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpcf_donate Shortcode CVSS 6.4 · 25.10.202412.12.20244.3WP Crowdfunding <= 2.1.12 - Missing Authorization to Authenticated (Subscriber+) WooCommerce Installation CVSS 4.3 · 12.12.20246.4WP Crowdfunding <= 2.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 12.12.202411.03.20255.3WP Crowdfunding <= 2.1.14 - Missing Authorization to Authenticated (Subscriber+) Post Content Download CVSS 5.3 · 11.03.202501.04.20256.4WP Crowdfunding <= 2.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 01.04.202510.08.20264.3Crowdfunding <= 2.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Order Data Disclosure CVSS 4.3 · 10.08.20264.3Crowdfunding <= 2.2.0 - Missing Authorization CVSS 4.3 · 10.08.202614.08.20264.3WP Crowdfunding < 2.2.1 - Unauthenticated Insecure Direct Object Reference CVSS 4.3 · 14.08.20264.3WP Crowdfunding < 2.2.1 - Missing Authorization CVSS 4.3 · 14.08.202608.09.20264.9WP Crowdfunding <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection via 'wpneo_reward' Post Meta CVSS 4.9 · 08.09.20266.4WP Crowdfunding <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' Parameter CVSS 6.4 · 08.09.2026

Strategic Overview

Avg CVSSMedium
5.1/ 10
Patch Coverage100%
Open

0

Fixed

19

Get automatic notifications for all WP Crowdfunding vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2026-19945

WP Crowdfunding <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' Parameter

Read the full analysis

Vulnerability Records

19 records
2026-09-08 15:51CVE-2026-19945
6.4
Medium
Wordfence PRISMYes
2026-09-08 15:02CVE-2026-19944
4.9
Medium
Wordfence PRISMYes
2026-08-14 00:00CVE-2026-73189
4.3
Medium
Jakub HermanYes
2026-08-14 00:00CVE-2026-14857
4.3
Medium
Sanjorn KeeratirungsanYes
2026-08-10 00:00CVE-2026-14858
4.3
Medium
Sajjad HaqiYes
2026-08-10 00:00CVE-2026-14859
4.3
Medium
Sajjad HaqiYes
2025-04-01 00:00CVE-2025-31892
6.4
Medium
theviper17yYes
2025-03-11 14:22CVE-2025-1508
5.3
Medium
Krzysztof ZającYes
2024-12-12 20:17CVE-2024-11911
4.3
Medium
Tieu Pham Trong NhanYes
2024-12-12 20:17CVE-2024-11910
6.4
Medium
theviper17yYes
Showing 1–10 of 19 reports
WP Crowdfunding banner
Latestv2.2.2

WP Crowdfunding

Themeum

Author

Themeum

4.4(89)
88/100
Last Updated
2026-09-02 (11d ago)
Active Installs
2,000+
Downloads
163,637
Requires WP
5.9+
Requires PHP
0+
Tested up to
WP 7.1
Created
2016-08-02 (10y ago)

WP Crowdfunding is a WooCommerce based plugin that empowers anyone to create a crowdfunding site using WordPress content management system. It’s very user-friendly and convenient to manage. Most of the basic WP Crowdfunding features are offered in this free version. Advanced features like centralised Native Wallet System, Stripe Connect, analytical reports, email notifications, unlimited rewards and so on are available in paid versions. Please read the documentation. Documentation Try WP Crowdfunding http://try.themeum.com/plugins/wp-crowdfunding/ Features Here are the most notable features of WP Crowdfunding plugin. If you need any further information, please feel free to contact us. Below are the best offerings of WP Crowdfunding. Submitting/Adding a Project Dedicated user registration feature Frontend project submission form Project start & end date options Setting a featured image and video Minimum & maximum price options Define a recommended price Declare a funding goal Reward system with estimated delivery date (1 reward in the free version) Campaign end method (Target goal) Campaign end method (Target date) Campaign end method (Target goal & date) Campaign end method (Campaign never ends) More Options for a Published Project Project update option Display the backer(s) in project single page Display the backer(s) name as anonymous Features: Frontend Dashboard Sections for Users Update the profile and contact information See own projects list Check the backed projects list Explore the received pledges list Visit bookmarks list (favorited projects) Change account password Advanced Features for Admins and Developers Template overriding option for developers Standard WordPress dashboard access for WP Crowdfunding, WooCommerce and other configurations Adding and handling the payment methods Exclusive Features in the Paid Version Unlimited rewards with estimated delivery date Native Wallet System to track, calculate, record and distribute all funds (an alternative system of Stripe Connect) Google reCAPTCHA Email notifications Analytical reports Social share Stripe Connect 1 Year plugin update 1 Year Support Plugin package includes an exclusive dedicated theme Many more feature coming soon Please let us know your feedback, if you think something can be more awesome this plugin, we will added it. Shortcode List To use these shortcodes, just place the required shortcode(s) on your desired location. Listing Shortcode [wpcf_listing] Listing Shortcode with specific category [wpcf_listing cat=”cat_name”] Submission Form Shortcode [wpcf_form] Search Shortcode [wpcf_search] Crowdfunding User Dashboard Shortcode [wpcf_dashboard] Crowdfunding User Registration Shortcode [wpcf_registration] Single Campaign [wpcf_single_campaign campaign_id=”post_id”] Campaign Box [wpcf_campaign_box campaign_id=”post_id”] Popular Campaigns [wpcf_popular_campaigns limit=”4&#8243; column=”4&#8243; order=”DESC” class=””] Donate [wpcf_donate campaign_id=”124&#8243; amount=”9000&#8243; min_amount=”5&#8243; max_amount=”1000&#8243; show_input_box=”true” donate_button_text=”Donate”] Pro Version Pro Plugin Crowdfunding Themes Backer Crowdfunding Theme BackNow Crowdfunding Theme Patrios Crowdfunding Theme Author Developed by Themeum

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C