The Crowdfunding for WooCommerce plugin for WordPress suffers from a stored XSS vulnerability due to improper neutralization of input in the 'width' parameter. This allows authenticated users with Contributor or higher privileges to inject arbitrary JavaScript code into pages. The injected scripts execute in the context of users viewing those pages, potentially leading to information disclosure or session hijacking. The vulnerability affects all versions up to and including 3.1.14. No known exploits are reported in the wild, and no patch or fix details are currently available.

Successful exploitation allows an authenticated user with Contributor-level access or higher to inject persistent malicious scripts into pages generated by the plugin. This can lead to limited confidentiality and integrity impacts, such as theft of user session data or execution of unauthorized actions within the affected site context. There is no direct impact on availability. The vulnerability requires authentication and low attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit Contributor-level access to trusted users only. Consider applying web application firewall (WAF) rules to detect and block suspicious input in the 'width' parameter. Monitor plugin updates from wpwham for an official fix.