{"id":"CVE-2026-42692","kind":"vulnerability","aliases":["CVE-2026-42692"],"related":[],"title":"WP Crowdfunding WordPress plugin: unauthenticated XSS through 2.2.2","description":"Unauthenticated Cross Site Scripting (XSS) in WP Crowdfunding <= 2.2.2 versions.","summary":"WP Crowdfunding, a WordPress plugin, has a cross-site scripting flaw in versions up to and including 2.2.2 that needs no login. An attacker can inject script that runs in a visitor's or administrator's browser.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"wp-crowdfunding","fixed":[],"affected":"<= 2.2.2","ecosystem":"wordpress"}],"ecosystems":[],"tags":["package","self-hosted","wordpress","wp-crowdfunding"],"not_affected_if":["plugin-deactivated-and-removed","plugin-not-installed"],"how_to_check":"- Check the installed WP Crowdfunding plugin version in the WordPress admin under Plugins, or with `wp plugin get wp-crowdfunding --field=version`\n- Flag any version at or below `2.2.2` for review","fix":"No patched version exists as of 2026-10-29; 2.2.2 is the latest release. Until the developer (Themeum) ships one, deactivate and remove the plugin or restrict it.","status":"open","published_at":"2026-10-29T16:18:09+00:00","first_seen_at":"2026-10-29T16:25:59+00:00","triaged_at":"2026-10-29T16:29:59+00:00","updated_at":"2026-10-29T16:36:47+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T16:29:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WP Crowdfunding WordPress plugin: unauthenticated XSS through 2.2.2","impact":"medium","summary":"WP Crowdfunding, a WordPress plugin, has a cross-site scripting flaw in versions up to and including 2.2.2 that needs no login. An attacker can inject script that runs in a visitor's or administrator's browser.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-crowdfunding","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker script runs in visitors' browsers on the site","analyst_note":"Find the fixed plugin version and the vulnerable endpoint or parameter in the NVD entry or the Wordfence/WPScan advisory for CVE-2026-42692.","how_to_check":"- Check the installed WP Crowdfunding plugin version in the WordPress admin under Plugins, or with `wp plugin get wp-crowdfunding --field=version`\n- Flag any version at or below `2.2.2` for review","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the WP Crowdfunding WordPress plugin at version 2.2.2 or earlier are exposed, since the flaw is reachable without authentication. The sources do not say which plugin features or pages are needed to trigger it, so sites with the plugin active should be treated as potentially exposed. Sites that do not run this plugin are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000704,"input_tokens":4072,"output_tokens":593,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed plugin version and the vulnerable endpoint or parameter in the NVD entry or the Wordfence/WPScan advisory for CVE-2026-42692.","search":"'-2026':10A,13A '-42692':11A,14A '2.2.2':8A,44B,72C 'administr':61B 'attack':50B 'browser':63B 'cross':34B,65C 'cross-sit':33B 'crowdfund':2A,25B,27B,71C 'crowdfunding':17A 'cve':9A,12A 'flaw':37B 'host':21B 'includ':43B 'inject':52B 'login':48B 'need':46B 'packag':18B 'plugin':4A,30B 'run':55B 'script':36B,53B,67C 'self':20B 'self-host':19B 'site':35B,66C 'unauthent':5A,64C 'version':39B,73C 'visitor':58B 'wordpress':3A,22B,29B 'wp':1A,16A,24B,26B,70C 'wp-crowdfund':23B 'wp-crowdfunding':15A 'xss':6A,68C","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site with the WP Crowdfunding plugin (by Themeum) active at version 2.2.2 or earlier. No login is needed to trigger it, but CVSS marks user interaction required: a visitor or admin must open a crafted link or page. Sites without the plugin can skip it.","tier":"B","verified":{"fix":{"at":"2026-10-29T16:36:47Z","by":"analyst","doc":"https://patchstack.com/database/wordpress/plugin/wp-crowdfunding/vulnerability/wordpress-wp-crowdfunding-plugin-2-2-2-cross-site-scripting-xss-vulnerability","run_id":1074}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-42692","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42692","severity":null,"published_at":"2026-10-29T16:18:09+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:25:59+00:00","fetched_at":"2026-10-29T16:25:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-42692:1074","url":null,"severity":null,"published_at":"2026-10-29T16:36:47+00:00","modified_at":"2026-10-29T16:36:47+00:00","first_seen_at":"2026-10-29T16:36:47+00:00","fetched_at":"2026-10-29T16:36:47+00:00","note":"Patchstack (the CNA) lists <=2.2.2 XSS, CVSS 7.1 (UI required), no official patch, 2.2.2 is latest. Vulnerable parameter/endpoint not published. Not exploited, no PoC found. Fix marked none per Patchstack page; didn't read the vendor's own page."}],"documents":[{"id":17794,"url":"https://patchstack.com/database/wordpress/plugin/wp-crowdfunding/vulnerability/wordpress-wp-crowdfunding-plugin-2-2-2-cross-site-scripting-xss-vulnerability","title":"Patchstack: WP Crowdfunding <= 2.2.2 XSS (no official patch)","kind":"advisory","source":"analyst","publisher":null,"text":"WordPress WP Crowdfunding Plugin <= 2.2.2 vulnerable to Cross Site Scripting (XSS). CVSS 7.1. No official patch available. User interaction required. Published 13 Oct 2026 by Patchstack. Latest plugin version 2.2.2 (Themeum), ~2,000 installs.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}