Live › vulnerability › CVE-2026-42692
WP Crowdfunding, a WordPress plugin, has a cross-site scripting flaw in versions up to and including 2.2.2 that needs no login. An attacker can inject script that runs in a visitor's or administrator's browser.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Any WordPress site with the WP Crowdfunding plugin (by Themeum) active at version 2.2.2 or earlier. No login is needed to trigger it, but CVSS marks user interaction required: a visitor or admin must open a crafted link or page. Sites without the plugin can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| wp-crowdfunding | wordpress | <= 2.2.2 | – |
wp plugin get wp-crowdfunding --field=version2.2.2 for review2.2.2 is the latest releaseEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated Cross Site Scripting (XSS) in WP Crowdfunding <= 2.2.2 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-42692")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.