CVE-2026-76063: FundEngine WordPress Plugin XSS Vulnerability

CVE-2026-76063 Overview

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 1.8.1. The flaw resides in the wfp_featured_video_url parameter, which lacks input sanitization and output escaping [CWE-79]. A REST endpoint responsible for accepting the video URL sets its permission_callback to __return_true, exposing the vulnerable code path to any authenticated user. Attackers holding Subscriber-level access or higher can inject arbitrary web scripts that execute when other users load the affected page.

Critical Impact

Authenticated attackers with Subscriber-level access can inject persistent JavaScript that executes in the browsers of visitors and administrators, enabling session hijacking, forced actions, and content manipulation.

Affected Products

• FundEngine – Donation and Crowdfunding Platform plugin for WordPress (all versions ≤ 1.8.1)
• WordPress sites using the wp-fundraising-donation plugin
• Any WordPress installation permitting Subscriber-level or higher user registration alongside the affected plugin

Discovery Timeline

• 2026-08-25 - CVE-2026-76063 published to NVD
• 2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-76063

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the FundEngine crowdfunding plugin. The plugin exposes a REST API endpoint that accepts a featured video URL through the wfp_featured_video_url parameter. The endpoint is registered with permission_callback set to __return_true, so WordPress performs no capability check before invoking the handler. Any authenticated session, including Subscriber accounts created through open registration, can reach the sink. The submitted value is later rendered into page output without being passed through WordPress escaping functions such as esc_url or esc_attr. As a result, attacker-controlled markup and JavaScript are stored and served to any visitor loading the affected page.

Root Cause

Two defects combine to create the vulnerability. First, the REST route lacks authorization: __return_true unconditionally approves the request. Second, the plugin fails to sanitize input on write and does not escape output on render, violating the WordPress secure development guidance for handling user-supplied URLs and attributes. Vulnerable code paths are visible in apps/content.php at lines 1198 and 1425, and in apps/featured.php at lines 175 and 467.

Attack Vector

An attacker registers or authenticates as a low-privilege user, then issues a request to the REST endpoint containing a malicious payload in the wfp_featured_video_url field. The payload is stored in the database and reflected into HTML output when any user, including administrators, visits the page. Because the injection scope is CHANGED, the executing script runs in the context of the WordPress site and can be used to steal session cookies, perform administrative actions via nonce reuse, or redirect users to attacker-controlled infrastructure.

The vulnerability is described in prose because no verified proof-of-concept code is available. Refer to the Wordfence Vulnerability Report and the WordPress Changeset Details for technical specifics of the fix.

Detection Methods for CVE-2026-76063

Indicators of Compromise

• Unexpected <script>, <iframe>, or javascript: fragments stored in FundEngine post metadata or database rows tied to featured video fields.
• REST API requests targeting FundEngine endpoints that submit wfp_featured_video_url values containing HTML control characters or protocol handlers other than http/https.
• Outbound browser requests from administrator sessions to unknown domains shortly after loading a FundEngine campaign page.

Detection Strategies

• Inspect the WordPress postmeta and plugin-managed tables for stored wfp_featured_video_url values that fail URL validation.
• Enable WordPress REST API logging and alert on POST requests from Subscriber-level accounts to wp-fundraising-donation routes.
• Use a web application firewall to identify request bodies containing script tags or event-handler attributes in URL parameters.

Monitoring Recommendations

• Monitor account creation activity on sites with open registration and correlate new Subscriber accounts with subsequent REST API activity.
• Track browser Content Security Policy (CSP) violation reports for unexpected inline script execution on campaign pages.
• Review administrator session activity for anomalous nonce-authorized actions immediately following visits to plugin-rendered pages.

How to Mitigate CVE-2026-76063

Immediate Actions Required

• Update the FundEngine – Donation and Crowdfunding Platform plugin to a version later than 1.8.1 that includes the fix from changeset 3656562.
• Audit stored plugin data for existing malicious payloads and purge any injected scripts before restoring public access.
• Rotate WordPress administrator passwords and invalidate active sessions if the site was reachable while vulnerable.

Patch Information

The fix is committed in the plugin's source repository. See the WordPress Changeset Details for the corrective commit and the Wordfence Vulnerability Report for advisory details.

Workarounds

• Disable open user registration or restrict new accounts to a role with no plugin access until patching is complete.
• Deploy a web application firewall rule that blocks non-URL characters and script markup submitted to FundEngine REST endpoints.
• Deactivate the FundEngine plugin on production sites that cannot be updated immediately.

# Configuration example: restrict WordPress registration and enforce Content Security Policy
wp option update users_can_register 0
wp option update default_role subscriber

# Add a restrictive CSP header via .htaccess to limit inline script execution
# Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'"