Vulnerabilities

TI-2024-06207 CVE-2024-6698 · GHSA-7f4q-mxmp-vrc9

FundEngine – Donation and Crowdfunding Platform <= 1.7.0 - Authenticated (Subscriber+) Privilege Escalation

MEDIUM 40

The FundEngine plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.0.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00431 Published 2024-08-01 No fix listed CWE-862

TI-2022-00697 CVE-2022-0788 · GHSA-xgvg-f3q7-ww4w

WP Fundraising Donation and Crowdfunding Platform < 1.5.0 - Unauthenticated SQLi

MEDIUM 53

The WP Fundraising Donation and Crowdfunding Platform WordPress plugin before 1.5.0 does not sanitise and escape a parameter before using it in a SQL statement via one of it's REST route, leading to an SQL injection expl…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0775 Published 2022-06-06 Fixed in 1.5.0 CWE-89

Vulnerabilities

Filters

FundEngine – Donation and Crowdfunding Platform <= 1.7.0 - Authenticated (Subscriber+) Privilege Escalation

WP Fundraising Donation and Crowdfunding Platform < 1.5.0 - Unauthenticated SQLi