CVE-2026-19945: WP Crowdfunding Plugin XSS Vulnerability

CVE-2026-19945 Overview

CVE-2026-19945 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the WP Crowdfunding plugin for WordPress. The flaw exists in all versions up to and including 2.2.1, and stems from insufficient input sanitization and output escaping on the first_name parameter. Authenticated attackers with subscriber-level access can inject arbitrary web scripts that execute when other users render the affected profile pages. When an administrator views a user profile through the ?show_user_id= parameter, the stored payload executes in the administrator's browser session, enabling cross-privilege script execution.

Critical Impact
Subscriber-level accounts can plant JavaScript that executes in an administrator's authenticated session, enabling account takeover, session theft, or backend actions performed on behalf of the admin.

Affected Products

WP Crowdfunding plugin for WordPress, versions up to and including 2.2.1
WordPress sites that expose the plugin's user profile dashboard
WordPress installations allowing subscriber-level registration with WP Crowdfunding active

Discovery Timeline

2026-09-09 - CVE-2026-19945 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-19945

Vulnerability Analysis

The vulnerability resides in the WP Crowdfunding profile handling logic, specifically in includes/woocommerce/Actions.php and the profile dashboard template at includes/woocommerce/dashboard/profile.php. The plugin accepts the first_name value submitted by an authenticated user but fails to sanitize input on write and does not escape the value on output. When the profile page is rendered, the raw value is emitted into the HTML context, allowing script tags or event handlers to execute.

A subscriber-level account is sufficient to inject the payload. The impact scope changes when an administrator loads a user's profile via ?show_user_id=, because the same unescaped value is rendered inside the admin's authenticated session. This crosses trust boundaries and elevates a low-privilege input flaw into an admin-context script execution issue.

Root Cause

The root cause is missing sanitization on input storage and missing output escaping when the first_name field is rendered. WordPress provides helpers such as sanitize_text_field() for storage and esc_html() or esc_attr() for output. Neither is applied consistently in the affected code paths.

Attack Vector

An attacker registers or uses an existing subscriber-level account, then submits a crafted first_name value containing JavaScript through the WP Crowdfunding profile update flow. The payload persists in user metadata. Any subsequent view of that profile, including administrator review through ?show_user_id=, executes the script in the viewer's browser. Exploitation is network-based and requires no user interaction beyond loading the profile page.

For code-level context, review the plugin source at WP Crowdfunding Actions.php L79, WP Crowdfunding Actions.php L116, and WP Crowdfunding profile.php L62.

Detection Methods for CVE-2026-19945

Indicators of Compromise

User meta records where first_name contains HTML tags, <script> markup, or on* event handler attributes.
Web server access logs showing POST requests to WP Crowdfunding profile update endpoints followed by administrator GET requests containing ?show_user_id=.
Unexpected outbound requests from admin browsers to attacker-controlled hosts shortly after an admin views a user profile.

Detection Strategies

Query the wp_usermeta table for first_name values matching patterns such as <, javascript:, or onerror= to identify stored payloads.
Enable a Web Application Firewall (WAF) rule set that flags XSS patterns in POST bodies targeting WooCommerce profile endpoints.
Correlate subscriber account creations with immediate profile updates as a behavioral signal for exploitation attempts.

Monitoring Recommendations

Alert on new WordPress user registrations followed by administrator page loads referencing the same user ID.
Monitor administrator sessions for anomalous XHR or fetch activity originating from profile view pages.
Ingest WordPress and web server logs into a centralized analytics platform to correlate low-privilege actions with high-privilege session behavior.

How to Mitigate CVE-2026-19945

Immediate Actions Required

Update the WP Crowdfunding plugin to a version later than 2.2.1 that includes the fix referenced in the WP Crowdfunding Changeset Overview.
Audit wp_usermeta for existing malicious first_name values and sanitize or clear them.
Rotate administrator credentials and invalidate active sessions if exploitation is suspected.

Patch Information

The vendor addressed the vulnerability in the changeset published to the WordPress plugin repository. Review the fix details at the WP Crowdfunding Changeset Overview and the Wordfence Vulnerability Report. Upgrade all WordPress sites running WP Crowdfunding to the patched release.

Workarounds

Restrict user registration to trusted roles until the plugin is updated.
Deploy a WAF rule that blocks HTML and script metacharacters in profile update requests.
Temporarily disable the WP Crowdfunding plugin on sites that cannot be updated immediately.

bash

# Configuration example: WP-CLI commands to update the plugin and audit user meta
wp plugin update wp-crowdfunding
wp db query "SELECT user_id, meta_value FROM wp_usermeta WHERE meta_key='first_name' AND meta_value REGEXP '<|javascript:|on[a-z]+=';"