The WP Crowdfunding WordPress plugin suffers from a stored XSS vulnerability (CWE-79) in all versions up to and including 2.2.1. The flaw exists because the 'first_name' parameter is not properly sanitized or escaped, allowing authenticated attackers with subscriber-level privileges or above to inject arbitrary JavaScript payloads. When an administrator accesses a profile page via the ?show_user_id= parameter, the stored malicious script executes in the admin's browser context, enabling cross-privilege script execution. This vulnerability has a CVSS 3.1 base score of 6.4, indicating a medium severity level. No official patch or remediation guidance is currently documented.

An attacker with subscriber-level access or higher can inject persistent malicious scripts via the 'first_name' parameter. These scripts execute in the context of an administrator's browser when viewing user profiles, potentially allowing the attacker to perform actions with elevated privileges or steal sensitive information accessible to the admin. The vulnerability does not affect availability but impacts confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user capabilities where possible and avoid administrators viewing untrusted user profiles. Monitor for updates from the vendor themeum regarding a security patch for WP Crowdfunding plugin versions up to 2.2.1.