WP Crowdfunding vulnerabilities | LiveThreat CVE Feed — Verisq

Login Request a demo

WC

Product

WP Crowdfunding

by themeum · last CVE Oct 29, 2026

16

CVEs

0

On KEV

8.8

Max CVSS

2

New 30D

Vulnerabilities16 In the news0 Timeline

Severity mix

Critical 0High 3Medium 13Low 0

Severity

All severities16 Critical0 High3 Medium13 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add WP Crowdfunding to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2023-41870	8.8	1%	Dec 13	WordPress WP Crowdfunding plugin <= 2.1.5 - Broken Access Control vulnerability Affected: through 2.1.5
CVE-2026-118083 New	7.5	–	Oct 29	WordPress WP Crowdfunding plugin <= 2.2.2 - Sensitive Data Exposure vulnerability Affected: through 2.2.2
CVE-2026-42692 New	7.1	–	Oct 29	WordPress WP Crowdfunding plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability Affected: through 2.2.2
CVE-2025-31892	6.5	0%	Apr 1	WordPress WP Crowdfunding plugin <= 2.1.15 - Cross Site Scripting (XSS) vulnerability Affected: through 2.1.15
CVE-2026-19945	6.4	0%	Sep 9	WP Crowdfunding <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' Parameter Affected: through 2.2.1
CVE-2023-6161	6.1	0%	Jan 8	WP Crowdfunding < 2.1.9 - Reflected XSS Affected: before 2.1.9
CVE-2023-47532	6.1	0%	Nov 14	WordPress WP Crowdfunding Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS) Affected: through 2.1.6
CVE-2024-11910	5.4	0%	Dec 13	WP Crowdfunding <= 2.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: through 2.1.15
CVE-2024-10117	5.4	0%	Oct 26	WP Crowdfunding <= 2.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpcf_donate Shortcode Affected: through 2.1.11
CVE-2023-50859	5.4	0%	Dec 28	WordPress WP Crowdfunding Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS) Affected: through 2.1.6
CVE-2025-1508	5.3	0%	Mar 12	WP Crowdfunding <= 2.1.14 - Missing Authorization to Authenticated (Subscriber+) Post Content Download Affected: through 2.1.14
CVE-2026-19944	4.9	0%	Sep 9	WP Crowdfunding <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection via 'wpneo_reward' Post Meta Affected: through 2.2.1
CVE-2023-6163	4.8	0%	Jan 15	WP Crowdfunding < 2.1.10 - Admin+ Stored XSS Affected: before 2.1.10
CVE-2023-5757	4.8	0%	Dec 11	WP Crowdfunding < 2.1.8 - Admin+ Stored XSS Affected: before 2.1.8
CVE-2024-11911	4.3	0%	Dec 13	WP Crowdfunding <= 2.1.12 - Missing Authorization to Authenticated (Subscriber+) WooCommerce Installation Affected: through 2.1.12
CVE-2024-43937	4.3	0%	Nov 1	WordPress WP Crowdfunding plugin <= 2.1.10 - Settings Change vulnerability Affected: through 2.1.10