Skip to content
OpenAdvisories

Product · Themeum

WP Crowdfunding

13 known vulnerabilities.

WP Crowdfunding at a glance

Last 12 months
4
Critical · all time
0
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 2 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 2 vulnerabilities Sep October 2026: 2 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202620
Sep 202620
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202510
Mar 202510
Feb 202500
Jan 202500
Dec 202430
All Critical High Medium Low Exploited only Public exploit

13 results · Feed

  • High 7.5
    CVE-2026-118083

    WordPress WP Crowdfunding plugin <= 2.2.2 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions.

    Themeum WP Crowdfunding
  • High 7.1
    CVE-2026-42692

    WordPress WP Crowdfunding plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in WP Crowdfunding <= 2.2.2 versions.

    Themeum WP Crowdfunding
  • Medium 6.4
    CVE-2026-19945

    WP Crowdfunding <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' Parameter

    The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticat…

    Themeum WP Crowdfunding Web / CMS
  • Medium 4.9
    CVE-2026-19944

    WP Crowdfunding <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection via 'wpneo_reward' Post Meta

    The WP Crowdfunding plugin for WordPress is vulnerable to generic SQL Injection via 'wpneo_reward' Post Meta in all versions up to, and including, 2.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the exis…

    Themeum WP Crowdfunding Web / CMS
  • Medium 6.5
    CVE-2025-31892

    WordPress WP Crowdfunding plugin <= 2.1.15 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum WP Crowdfunding wp-crowdfunding allows Stored XSS.This issue affects WP Crowdfunding: from n/a through <= 2.1.15.

    Themeum WP Crowdfunding
  • Medium 5.3
    CVE-2025-1508

    WP Crowdfunding <= 2.1.14 - Missing Authorization to Authenticated (Subscriber+) Post Content Download

    The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the download_data action in all versions up to, and including, 2.1.14. This makes it possible for authenticated attackers, with subscrib…

    Themeum WP Crowdfunding Web / CMS
  • Medium 4.3
    CVE-2023-41870

    WordPress WP Crowdfunding plugin <= 2.1.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Themeum WP Crowdfunding allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Crowdfunding: from n/a through 2.1.5.

    Themeum WP Crowdfunding
  • Medium 4.3
    CVE-2024-11911

    WP Crowdfunding <= 2.1.12 - Missing Authorization to Authenticated (Subscriber+) WooCommerce Installation

    The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the install_woocommerce_plugin() function action in all versions up to, and including, 2.1.12. This makes it possible for authentic…

    Themeum WP Crowdfunding Web / CMS
  • Medium 6.4
    CVE-2024-11910

    WP Crowdfunding <= 2.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wp-crowdfunding/search block in all versions up to, and including, 2.1.15 due to insufficient input sanitization and output escaping. This makes it possible for auth…

    Themeum WP Crowdfunding Web / CMS
  • Medium 6.4
    CVE-2024-43937

    WordPress WP Crowdfunding plugin <= 2.1.10 - Settings Change vulnerability

    Missing Authorization vulnerability in Themeum WP Crowdfunding allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Crowdfunding: from n/a through 2.1.10.

    Themeum WP Crowdfunding
  • Medium 6.4
    CVE-2024-10117

    WP Crowdfunding <= 2.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpcf_donate Shortcode

    The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcf_donate shortcode in all versions up to, and including, 2.1.11 due to insufficient input sanitization and output escaping on user supplied attributes. T…

    Themeum WP Crowdfunding Web / CMS
  • Medium 6.5
    CVE-2023-50859

    WordPress WP Crowdfunding Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum WP Crowdfunding allows Stored XSS.This issue affects WP Crowdfunding: from n/a through 2.1.6.

    Themeum WP Crowdfunding
  • Medium 5.8
    CVE-2023-47532

    WordPress WP Crowdfunding Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Themeum WP Crowdfunding plugin <= 2.1.6 versions.

    Themeum WP Crowdfunding