An unauthenticated Cross Site Scripting flaw exists in WordPress WP Crowdfunding plugin versions 2.2.2 and earlier, which allows an attacker to inject arbitrary JavaScript into the page. The vulnerability arises from unsanitized user input being reflected or stored, enabling malicious scripts to run in the context of site visitors. This can lead to defacement, theft of user credentials, session hijacking, or the execution of additional malicious payloads. The weakness is a classic reflective XSS identified as CWE-79.

The flaw affects WordPress installations that include the Themeum WP Crowdfunding plugin version 2.2.2 or older. Any site running these versions, regardless of the user role, is vulnerable because the injection point does not require authentication or elevated privileges. Administrators, editors, and anonymous visitors could all trigger the payload once the script is embedded.

The vulnerability carries a CVSS score of 7.1, indicating moderate to high severity. Although an EPSS score is not available, the lack of a CISA KEV listing and the public disclosure suggest that exploitation is plausible but not determined to be actively targeted at this time. Attackers would likely issue a crafted HTTP request to the plugin’s endpoint to inject the script, taking advantage of the unauthenticated nature of the flaw and the absence of input validation controls.