CVE-2026-76063: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in roxnor FundEngine – Donation and Crowdfunding Platform

CVE-2026-76063 describes a stored Cross-Site Scripting vulnerability in the FundEngine – Donation and Crowdfunding Platform WordPress plugin. The vulnerability arises from insufficient input sanitization and output escaping of the 'wfp_featured_video_url' parameter. Because the REST endpoint handling this parameter has its permission_callback set to __return_true, any authenticated user, including those with minimal subscriber privileges, can inject malicious scripts. These scripts are stored and executed when other users access the injected pages, potentially leading to session hijacking or other script-based attacks.

An attacker with subscriber-level access can inject persistent malicious scripts into pages via the vulnerable parameter. This can lead to the execution of arbitrary JavaScript in the context of other users visiting the affected pages, potentially compromising user sessions and data confidentiality. The vulnerability does not allow unauthenticated attackers to exploit it, but the low privilege required increases risk within compromised or untrusted user environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user capabilities if possible and monitor for suspicious activity related to the 'wfp_featured_video_url' parameter. Avoid granting unnecessary authenticated access to untrusted users.