CVE-2026-16538 TeraWallet - Wallet for WooCommerce < 1.6.10 - Subscriber+ Wallet Balance Inflation via Discounted Top-Up

The Wallet for WooCommerce WordPress plugin before 1.6.10 does not verify the amount actually collected for a wallet top-up before crediting the wallet, allowing customers to top up their wallet balance for less than its value...

CVE-2026-16977

The Form Maker by 10Web WordPress plugin (versions before 1.15.45 ) is vulnerable to second-order SQL injection . The flaw exists because the plugin fails to properly parameterize a user-controlled value substituted into a dynamic SQL query for a database-backed choice field. This allows users wi...

CVE-2026-16538

The Wallet for WooCommerce (also known as TeraWallet ) WordPress plugin in versions before 1.6.10 is vulnerable to a wallet balance inflation flaw. The root cause is a failure to verify the actual amount collected during a wallet top-up before crediting the account. This allows customers to top u...

CVE-2026-15388

The Cookie Consent WordPress plugin (versions before 0.0.10 ) contains an authorization flaw where it fails to properly enforce administrator-only capability checks on its consent-settings REST routes . Instead, these routes fall back to a general authentication-only gate. This allows any authent...

CVE-2026-15388 Cookie Consent < 0.0.10 - Subscriber+ Consent Settings Update and Consent Log Disclosure

The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST routes, so they fall back to an authentication-only gate, allowing any authenticated user such as a subscriber to update the Cookie Consent...

CVE-2026-15388

The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST routes, so they fall back to an authentication-only gate, allowing any authenticated user such as a subscriber to update the Cookie Consent...

CVE-2026-15388 Cookie Consent < 0.0.10 - Subscriber+ Consent Settings Update and Consent Log Disclosure

The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST routes, so they fall back to an authentication-only gate, allowing any authenticated user such as a subscriber to update the Cookie Consent...

EUVD-2026-57084

The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST routes, so they fall back to an authentication-only gate, allowing any authenticated user such as a subscriber to update the Cookie Consent...

CVE-2026-14858 WP Crowdfunding < 2.2.1 - Subscriber+ Order Data Disclosure via IDOR

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate every order in the store...

CVE-2026-14859

The WP Crowdfunding WordPress plugin (versions before 2.2.1 ) is vulnerable to an improper access control issue. The plugin fails to verify the campaign-submission capability within one of its AJAX actions . This allows authenticated users , such as those with Subscriber privileges, to create cro...

CVE-2026-14859 WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Creation via Missing Authorization

The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated users such as Subscribers to create crowdfunding campaign posts despite not being granted that permission...

CVE-2026-14859 WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Creation via Missing Authorization

The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated users such as Subscribers to create crowdfunding campaign posts despite not being granted that permission...

CVE-2026-14858

The WP Crowdfunding WordPress plugin (versions before 2.2.1 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The root cause is a failure to verify order ownership before returning order details. This allows any authenticated user, such as a Subscriber , to access the personal d...

CVE-2026-14858 WP Crowdfunding < 2.2.1 - Subscriber+ Order Data Disclosure via IDOR

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate every order in the store...

EUVD-2026-57080

The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated users such as Subscribers to create crowdfunding campaign posts despite not being granted that permission...

CVE-2026-14857

The WP Crowdfunding WordPress plugin versions prior to 2.2.1 is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The plugin fails to verify campaign ownership, allowing any authenticated user—including those with the Subscriber role—to modify the update history of campaigns belongin...

CVE-2026-14857 WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Update Modification via IDOR

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers, allowing any authenticated users such as Subscribers to alter other users' campaigns...

EUVD-2026-57078

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers, allowing any authenticated users such as Subscribers to alter other users' campaigns...

CVE-2026-14857 WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Update Modification via IDOR

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers, allowing any authenticated users such as Subscribers to alter other users' campaigns...

CVE-2026-14857

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers, allowing any authenticated users such as Subscribers to alter other users' campaigns...