The FundEngine plugin for WordPress is vulnerable to stored cross‑site scripting via the wfp_featured_video_url parameter in all versions up to 1.8.1 because the input is not properly sanitized before being stored and later output without escaping. This flaw allows an authenticated user with subscriber‑level access or higher to inject arbitrary JavaScript that will execute in the browsers of any visitor who views the affected page. The REST endpoint that receives the video URL uses a permission_callback returning __return_true, meaning any signed‑in user can submit the malicious value and trigger the vulnerable code path.

The vulnerability affects the roxnor FundEngine – Donation and Crowdfunding Platform plugin for WordPress, specifically versions 1.8.1 and all earlier releases. Any WordPress site deploying these versions will be susceptible.

The CVSS base score of 6.4 classifies this issue as medium severity. EPSS data is not available, so the likelihood of exploitation is uncertain, and the flaw does not appear in the CISA KEV catalog. Attackers need only authenticate to WordPress as at least a subscriber to reach the vulnerable REST endpoint, and because the endpoint allows all authenticated users, the barrier to exploitation remains low. Stored scripts executed in users’ browsers can lead to session hijacking, defacement, or phishing attacks on the site.