roxnor Vulnerabilities and Affected Products
Vulnerabilities associated with FundEngine.
Products
Clear product- MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor23 vulnerabilities
- ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor19 vulnerabilities
- Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers5 vulnerabilities
- EmailKit – Email Customizer for WooCommerce & WP4 vulnerabilities
- FundEngine4 vulnerabilities
- Wp Social Login and Register Social Counter4 vulnerabilities
- GetGenie3 vulnerabilities
- GetGenie – AI Content Writer with Keyword Research & SEO Tracking Tools3 vulnerabilities
- Metform3 vulnerabilities
- ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution3 vulnerabilities
- Wp Ultimate Review3 vulnerabilities
- ElementsKit Elementor addons Lite2 vulnerabilities
- PopupKit2 vulnerabilities
- EmailKit1 vulnerability
- FundEngine – Donation and Crowdfunding Platform1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-59560MEDIUM | WordPress FundEngine plugin <= 1.7.8 - Broken Access Control vulnerabilitySubscriber Broken Access Control in FundEngine <= 1.7.8 versions. CWE-862Jul 27, 2026 | CVSS6.5v3.1 | EPSS0.352% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-57406MEDIUM | WordPress FundEngine plugin <= 1.7.6 - Broken Access Control vulnerabilityMissing Authorization vulnerability in Roxnor FundEngine wp-fundraising-donation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FundEngine: from n/a through <= 1.7.6. CWE-862Jul 13, 2026 | CVSS6.5v3.1 | EPSS0.235% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-48302HIGH | WordPress FundEngine Plugin <= 1.7.4 - Local File Inclusion VulnerabilityImproper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Roxnor FundEngine wp-fundraising-donation allows PHP Local File Inclusion.This issue affects FundEngine: from n/a through <= 1.7.4. CWE-98Aug 20, 2025 | CVSS7.5v3.1 | EPSS0.482% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-47459MEDIUM | WordPress WP Fundraising Donation and Crowdfunding Platform plugin <= 1.7.3 - Cross Site Request Forgery (CSRF) VulnerabilityCross-Site Request Forgery (CSRF) vulnerability in Roxnor FundEngine wp-fundraising-donation allows Cross Site Request Forgery.This issue affects FundEngine: from n/a through <= 1.7.3. CWE-352May 7, 2025 | CVSS4.3v3.1 | EPSS0.158% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |