https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-1508.htmlhttps://patchthecve.com/cve/CVE-2025-1508.htmlWed, 17 Jun 2026 08:39:16 +0000MEDIUM 5.3: The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the download_data action in all versions up to, and including, 2.1.14. This makes it possible for authenticated attackers, with subscriber-level access and above, to download alhttps://patchthecve.com/cve/CVE-2023-41870.htmlhttps://patchthecve.com/cve/CVE-2023-41870.htmlWed, 17 Jun 2026 06:22:58 +0000MEDIUM 4.3: Missing Authorization vulnerability in Themeum WP Crowdfunding allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Crowdfunding: from n/a through 2.1.5.https://patchthecve.com/cve/CVE-2024-11911.htmlhttps://patchthecve.com/cve/CVE-2024-11911.htmlWed, 17 Jun 2026 06:58:41 +0000MEDIUM 4.3: The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the install_woocommerce_plugin() function action in all versions up to, and including, 2.1.12. This makes it possible for authenticated attackers, with Subscriber-level acchttps://patchthecve.com/cve/CVE-2024-11910.htmlhttps://patchthecve.com/cve/CVE-2024-11910.htmlWed, 17 Jun 2026 06:58:41 +0000MEDIUM 6.4: The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wp-crowdfunding/search block in all versions up to, and including, 2.1.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-levhttps://patchthecve.com/cve/CVE-2024-43937.htmlhttps://patchthecve.com/cve/CVE-2024-43937.htmlWed, 17 Jun 2026 07:52:01 +0000MEDIUM 6.4: Missing Authorization vulnerability in Themeum WP Crowdfunding allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Crowdfunding: from n/a through 2.1.10.https://patchthecve.com/cve/CVE-2024-10117.htmlhttps://patchthecve.com/cve/CVE-2024-10117.htmlWed, 17 Jun 2026 06:54:56 +0000MEDIUM 6.4: The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcf_donate shortcode in all versions up to, and including, 2.1.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated a