Roxnor Fundengine vulnerabilities

• roxnor fundengine – donation and crowdfunding platform FundEngine <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wfp_featured_video_url' Parameter CVE-2026-76063 6.4 MediumAugust 25, 2026
• roxnor fundengine – donation and crowdfunding platform FundEngine <= 1.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'campaign_post' Parameter CVE-2026-75930 4.3 MediumAugust 25, 2026
• roxnor fundengine WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability CVE-2026-73993 9.8 CriticalAugust 20, 2026
• roxnor fundengine WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability CVE-2026-32470 9.8 CriticalAugust 18, 2026
• roxnor fundengine WordPress FundEngine plugin <= 1.7.8 - Broken Access Control vulnerability CVE-2026-59560 6.5 MediumJuly 27, 2026
• roxnor fundengine WordPress FundEngine plugin <= 1.7.6 - Broken Access Control vulnerability CVE-2026-57406 6.5 MediumJuly 13, 2026
• roxnor fundengine WordPress FundEngine Plugin <= 1.7.4 - Local File Inclusion Vulnerability CVE-2025-48302 7.5 HighAugust 20, 2025
• roxnor fundengine WordPress WP Fundraising Donation and Crowdfunding Platform plugin <= 1.7.3 - Cross Site Request Forgery (CSRF) Vulnerability CVE-2025-47459 4.3 MediumMay 7, 2025
• roxnor fundengine – donation and crowdfunding platform, wpmet fundengine, wp fundraising donation and crowdfunding platform +2 more FundEngine – Donation and Crowdfunding Platform <= 1.7.0 - Authenticated (Subscriber+) Privilege Escalation CVE-2024-6698 8.8 HighAugust 1, 2024