EUVD lists unauthenticated XSS in WP Crowdfunding up to 2.2.2 (EUVD-2026-112946)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Themeum
- Product
- WP Crowdfunding
- First seen
Summary
The EUVD entry, shared on Mastodon, describes an unauthenticated cross-site scripting flaw in WP Crowdfunding versions up to 2.2.2, with a CVSS v3.1 score of 7.1. The listing is from ENISA's European Vulnerability Database.
If you use Themeum
Check whether WP Crowdfunding 2.2.2 or earlier is installed
Update to a fixed WP Crowdfunding release
Review site content for injected scripts
Update the Kirki plugin to version 6.4.1 or later
Review Kirki page REST API activity and page edits for unexpected changes
Restrict REST API access on WordPress sites where Kirki is installed until patched
What the sources say 5
· Mastodon: “Unauthenticated Cross Site Scripting (XSS) in WP Crowdfunding <= 2.2.2 versions.” Source
· Mastodon: “Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API” Source
· Mastodon: “Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability” Source
· Mastodon: “Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Kirki kirki allows Code Injection.” Source
· Mastodon: “Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions.” Source