Extension WordPress
Vulnérabilités WP Crowdfunding
Cette page rassemble les failles publiées pour WP Crowdfunding, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de WP Crowdfunding
13 fiches
WP Crowdfunding <= 2.1.15 – Authenticated (Contributor+) Stored Cross-Site Scripting
The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.1.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and…
*-2.1.15
2.1.16
01/04/2025
WP Crowdfunding <= 2.1.14 – Missing Authorization to Authenticated (Subscriber+) Post Content Download
The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the download_data action in all versions up to, and including, 2.1.14. This makes it possible for authenticated attackers,…
*-2.1.14
2.1.15
11/03/2025
WP Crowdfunding <= 2.1.12 – Missing Authorization to Authenticated (Subscriber+) WooCommerce Installation
The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the install_woocommerce_plugin() function action in all versions up to, and including, 2.1.12. This makes it possible for authenticated attackers,…
*-2.1.12
2.1.13
12/12/2024
WP Crowdfunding <= 2.1.15 – Authenticated (Contributor+) Stored Cross-Site Scripting
The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wp-crowdfunding/search block in all versions up to, and including, 2.1.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
*-2.1.15
2.1.16
12/12/2024
WP Crowdfunding <= 2.1.11 – Authenticated (Contributor+) Stored Cross-Site Scripting via wpcf_donate Shortcode
The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcf_donate shortcode in all versions up to, and including, 2.1.11 due to insufficient input sanitization and output escaping on user supplied attributes. This…
*-2.1.11
2.1.12
25/10/2024
WP Crowdfunding <= 2.1.10 – Missing Authorization to Authenticated (Subscriber+) to Enable/Disable Addons
The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the addon_enable_disable() function in all versions up to, and including, 2.1.10. This makes it possible for authenticated attackers,…
*-2.1.10
2.1.11
26/08/2024
WP Crowdfunding <= 2.1.9 – Authenticated (Admin+) Stored Cross-Site Scripting
The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,…
*-2.1.9
2.1.10
22/12/2023
WP Crowdfunding <= 2.1.6 – Authenticated (Contributor+) Stored Cross-Site Scripting
The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level and…
*-2.1.6
2.1.7
22/12/2023
WP Crowdfunding <= 2.1.8 – Reflected Cross-Site Scripting
The WP Crowdfunding plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…
*-2.1.8
2.1.9
13/12/2023
WP Crowdfunding <= 2.1.7 – Authenticated (Admin+) Stored Cross-Site Scripting
The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,…
*-2.1.7
2.1.8
28/11/2023
WP Crowdfunding <= 2.1.6 – Reflected Cross-Site Scripting via postid
The WP Crowdfunding plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘postid’ parameter in versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers…
*-2.1.6
2.1.7
07/11/2023
WP Crowdfunding <= 2.1.5 – Cross-Site Request Forgery
The WP Crowdfunding plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1.5. This is due to missing or incorrect nonce validation on the settings_reset function. This makes it possible for unauthenticated…
*-2.1.5
2.1.6
08/09/2023
WP Crowdfunding <= 2.1.4 – Missing Authorization via settings_reset
The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized settings reset due to a missing capability check on the settings_reset function in versions up to, and including, 2.1.4. This makes it possible for authenticated attackers, with subscriber-level…
*-2.1.4
2.1.5
05/09/2023
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.