Advisories · Technology

Themeum WP Crowdfunding.

Every CVE that names Themeum WP Crowdfunding among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-118083 CVE record

CVSS 7.5 High

WordPress WP Crowdfunding plugin <= 2.2.2 - Sensitive Data Exposure vulnerability
- Themeum WP Crowdfunding
- Information disclosure
Not analysed yet 29 Oct 2026
CVE-2026-42692 CVE record

CVSS 7.1 High

WordPress WP Crowdfunding plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability
- Themeum WP Crowdfunding
- Cross-site scripting (XSS)
Not analysed yet 29 Oct 2026
CVE-2026-19945 CVE record

CVSS 6.4 Medium

WP Crowdfunding <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' Parameter
- themeum WP Crowdfunding
- Cross-site scripting (XSS)
Not analysed yet 9 Sept 2026
CVE-2026-19944 CVE record

CVSS 4.9 Medium

WP Crowdfunding <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection via 'wpneo_reward' Post Meta
- themeum WP Crowdfunding
- SQL injection
Not analysed yet 9 Sept 2026
CVE-2025-31892 CVE record

CVSS 6.5 Medium

WordPress WP Crowdfunding plugin <= 2.1.15 - Cross Site Scripting (XSS) vulnerability
- Themeum WP Crowdfunding
- Cross-site scripting (XSS)
Not analysed yet 1 Apr 2025
CVE-2025-1508 CVE record

CVSS 5.3 Medium

WP Crowdfunding <= 2.1.14 - Missing Authorization to Authenticated (Subscriber+) Post Content Download
- themeum WP Crowdfunding
- Broken access control
Not analysed yet 12 Mar 2025
CVE-2023-41870 CVE record

CVSS 4.3 Medium

WordPress WP Crowdfunding plugin <= 2.1.5 - Broken Access Control vulnerability
- Themeum WP Crowdfunding
- Broken access control
Not analysed yet 13 Dec 2024
CVE-2024-11910 CVE record

CVSS 6.4 Medium

WP Crowdfunding <= 2.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
- themeum WP Crowdfunding
- Cross-site scripting (XSS)
Not analysed yet 13 Dec 2024
CVE-2024-11911 CVE record

CVSS 4.3 Medium

WP Crowdfunding <= 2.1.12 - Missing Authorization to Authenticated (Subscriber+) WooCommerce Installation
- themeum WP Crowdfunding
- Broken access control
Not analysed yet 13 Dec 2024
CVE-2024-43937 CVE record

CVSS 6.4 Medium

WordPress WP Crowdfunding plugin <= 2.1.10 - Settings Change vulnerability
- Themeum WP Crowdfunding
- Broken access control
Not analysed yet 1 Nov 2024
CVE-2024-10117 CVE record

CVSS 6.4 Medium

WP Crowdfunding <= 2.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpcf_donate Shortcode
- themeum WP Crowdfunding
- Cross-site scripting (XSS)
Not analysed yet 26 Oct 2024
CVE-2023-50859 CVE record

CVSS 6.5 Medium

WordPress WP Crowdfunding Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS)
- Themeum WP Crowdfunding
- Cross-site scripting (XSS)
Not analysed yet 28 Dec 2023
CVE-2023-47532 CVE record

CVSS 5.8 Medium

WordPress WP Crowdfunding Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS)
- Themeum WP Crowdfunding
- Cross-site scripting (XSS)
Not analysed yet 14 Nov 2023