Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

11 records

Vendor: themeum Component: Wp Crowdfunding Clear all filters
TI-2023-22263 CVE-2023-41870 · GHSA-33wx-gh7x-xv44

WordPress WP Crowdfunding plugin <= 2.1.5 - Broken Access Control vulnerability

Priority MEDIUM 40

Missing Authorization vulnerability in Themeum WP Crowdfunding allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Crowdfunding: from n/a through 2.1.5.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00833 Published 2024-12-13 No fix listed CWE-862
TI-2024-11049 CVE-2024-11910 · GHSA-fcxx-gwmh-4jq4

WP Crowdfunding <= 2.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting

Priority LOW 28

The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wp-crowdfunding/search block in all versions up to, and including, 2.1.15 due to insufficient input sanitization and output es…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00321 Published 2024-12-13 No fix listed CWE-79
TI-2024-11050 CVE-2024-11911 · GHSA-p3vh-4cmg-x98x

WP Crowdfunding <= 2.1.12 - Missing Authorization to Authenticated (Subscriber+) WooCommerce Installation

Priority LOW 20

The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the install_woocommerce_plugin() function action in all versions up to, and including, 2.1.1…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0028 Published 2024-12-13 No fix listed CWE-862
TI-2024-29526 CVE-2024-43937 · GHSA-2xpj-7m85-mm88

WordPress WP Crowdfunding plugin <= 2.1.10 - Settings Change vulnerability

Priority LOW 28

Missing Authorization vulnerability in Themeum WP Crowdfunding allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Crowdfunding: from n/a through 2.1.10.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00358 Published 2024-11-01 No fix listed CWE-862
TI-2024-09378 CVE-2024-10117 · GHSA-76qm-ghrw-c3h6

WP Crowdfunding <= 2.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpcf_donate Shortcode

Priority LOW 29

The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcf_donate shortcode in all versions up to, and including, 2.1.11 due to insufficient input sanitization and output…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00392 Published 2024-10-26 No fix listed CWE-79
TI-2023-05667 CVE-2023-6163 · GHSA-28ww-2383-hmp7

WP Crowdfunding < 2.1.10 - Admin+ Stored XSS

Priority MEDIUM 55

The WP Crowdfunding WordPress plugin before 2.1.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfi…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00402 Published 2024-01-15 Fixed in 2.1.10 CWE-79
TI-2023-05666 CVE-2023-6161 · GHSA-m866-4h9x-6c44

WP Crowdfunding < 2.1.9 - Reflected XSS

Priority MEDIUM 60

The WP Crowdfunding WordPress plugin before 2.1.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege use…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0042 Published 2024-01-08 Fixed in 2.1.9 CWE-79
TI-2023-05295 CVE-2023-5757 · GHSA-wmg7-q748-7jqq

WP Crowdfunding < 2.1.8 - Admin+ Stored XSS

Priority LOW 22

The WP Crowdfunding WordPress plugin before 2.1.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfil…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00451 Published 2023-12-11 Fixed in 2.1.8 CWE-79