CVE-2026-76063 is a stored cross-site scripting vulnerability in the FundEngine – Donation and Crowdfunding Platform WordPress plugin. The vulnerability arises from insufficient input sanitization and output escaping of the 'wfp_featured_video_url' parameter. The REST endpoint used to submit this parameter has its permission_callback set to __return_true, allowing any authenticated user, including those with subscriber-level access, to inject malicious scripts. These scripts execute whenever a user accesses the injected page, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to and including 1.8.1.

An attacker with subscriber-level access or higher can inject malicious JavaScript code that executes in the context of other users viewing the affected pages. This can lead to the theft of sensitive information such as session tokens or other user data, and may allow further attacks within the affected WordPress site. The vulnerability does not impact availability but compromises confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles that can access the REST endpoint or disable the vulnerable plugin if possible. Monitor for suspicious activity related to script injection. Avoid granting unnecessary authenticated access to untrusted users.