CVE-2024-10117

Published
View on NVD ↗
CVSS v3
6.4
MEDIUM
CVSS v2
N/A
Affected
1
PROJECT

Description

The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcf_donate shortcode in all versions up to, and including, 2.1.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

<p>WP Crowdfunding is a WooCommerce based plugin that empowers anyone to create a crowdfunding site using WordPress content management system. It’s very user-friendly and convenient to manage. Most of the basic WP Crowdfunding features are offered in this free version. Advanced features like centralised Native Wallet System, Stripe Connect, analytical reports, email notifications, unlimited rewards and so on are available in paid versions.</p> <span class="embed-youtube" style="text-align:center; display: block;"><iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/jHJBV2MbgBw?version=3&#038;rel=1&#038;showsearch=0&#038;showinfo=1&#038;iv_load_policy=1&#038;fs=1&#038;hl=en-US&#038;autohide=2&#038;wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe></span> <p>Please read the documentation.<br /> <a href="https://docs.themeum.com/wp-crowdfunding/" rel="nofollow ugc">Documentation</a></p> <blockquote> <p>Try WP Crowdfunding<br /> <a href="http://try.themeum.com/plugins/wp-crowdfunding/" rel="nofollow ugc">http://try.themeum.com/plugins/wp-crowdfunding/</a></p> </blockquote> <h4>Features</h4> <p>Here are the most notable features of WP Crowdfunding plugin. If you need any further information, please feel free to contact us. Below are the best offerings of WP Crowdfunding.</p> <h4>Submitting/Adding a Project</h4> <ul> <li>Dedicated user registration feature</li> <li>Frontend project submission form</li> <li>Project start &amp; end date options</li> <li>Setting a featured image and video</li> <li>Minimum &amp; maximum price options</li> <li>Define a recommended price</li> <li>Declare a funding goal</li> <li>Reward system with estimated delivery date (1 reward in the free version)</li> <li>Campaign end method (Target goal)</li> <li>Campaign end method (Target date)</li> <li>Campaign end method (Target goal &amp; date)</li> <li>Campaign end method (Campaign never ends)</li> </ul> <h4>More Options for a Published Project</h4> <ul> <li>Project update option</li> <li>Display the backer(s) in project single page</li> <li>Display the backer(s) name as anonymous</li> </ul> <h4>Features: Frontend Dashboard Sections for Users</h4> <ul> <li>Update the profile and contact information</li> <li>See own projects list</li> <li>Check the backed projects list</li> <li>Explore the received pledges list</li> <li>Visit bookmarks list (favorited projects)</li> <li>Change account password</li> </ul> <h4>Advanced Features for Admins and Developers</h4> <ul> <li>Template overriding option for developers</li> <li>Standard WordPress dashboard access for WP Crowdfunding, WooCommerce and other configurations</li> <li>Adding and handling the payment methods</li> </ul> <h4>Exclusive Features in the Paid Version</h4> <ul> <li>Unlimited rewards with estimated delivery date</li> <li>Native Wallet System to track, calculate, record and distribute all funds (an alternative system of Stripe Connect)</li> <li>Google reCAPTCHA</li> <li>Email notifications</li> <li>Analytical reports</li> <li>Social share</li> <li>Stripe Connect</li> <li>1 Year plugin update</li> <li>1 Year Support</li> <li>Plugin package includes an exclusive dedicated theme</li> <li>Many more feature coming soon</li> </ul> <p>Please let us know your feedback, if you think something can be more awesome this plugin, we will added it.</p> <h4>Shortcode List</h4> <p>To use these shortcodes, just place the required shortcode(s) on your desired location.</p> <ul> <li>Listing Shortcode [wpcf_listing]</li> <li>Listing Shortcode with specific category [wpcf_listing cat=&#8221;cat_name&#8221;]</li> <li>Submission Form Shortcode [wpcf_form]</li> <li>Search Shortcode [wpcf_search]</li> <li>Crowdfunding User Dashboard Shortcode [wpcf_dashboard]</li> <li>Crowdfunding User Registration Shortcode [wpcf_registration]</li> <li>Single Campaign [wpcf_single_campaign campaign_id=&#8221;post_id&#8221;]</li> <li>Campaign Box [wpcf_campaign_box campaign_id=&#8221;post_id&#8221;]</li> <li>Popular Campaigns [wpcf_popular_campaigns limit=&#8221;4&#8243; column=&#8221;4&#8243; order=&#8221;DESC&#8221; class=&#8221;&#8221;]</li> <li>Donate [wpcf_donate campaign_id=&#8221;124&#8243; amount=&#8221;9000&#8243; min_amount=&#8221;5&#8243; max_amount=&#8221;1000&#8243; show_input_box=&#8221;true&#8221; donate_button_text=&#8221;Donate&#8221;]</li> </ul> <h4>Pro Version</h4> <blockquote> <p><a href="https://www.themeum.com/product/wp-crowdfunding-plugin/" rel="nofollow ugc">Pro Plugin</a></p> </blockquote> <h4>Crowdfunding Themes</h4> <blockquote> <p><a href="https://www.themeum.com/product/backer/" rel="nofollow ugc">Backer Crowdfunding Theme</a><br /> <a href="https://themeforest.net/item/backnow-crowdfunding-and-fundraising-wordpress-theme/" rel="nofollow ugc">BackNow Crowdfunding Theme</a><br /> <a href="https://www.themeum.com/product/patrios/" rel="nofollow ugc">Patrios Crowdfunding Theme</a></p> </blockquote> <h4>Author</h4> <p>Developed by <a href="https://www.themeum.com" rel="nofollow ugc">Themeum</a></p>
WordPress Plugin DirectoryWordPress Plugin Directory
159K