CVE-2026-16538

The Wallet for WooCommerce WordPress plugin before 1.6.10 does not verify the amount actually collected for a wallet top-up before crediting the wallet, allowing customers to top up their wallet balance for less than its value...

EUVD-2026-57087

The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated users, allowing them to disclose sensitive backup information and to force a full site restore that overwrites the live site's...

CVE-2026-15388

The vulnerability pertains to the Cookie Consent WordPress plugin (versions before 0.0.10). The consent-settings REST routes do not correctly enforce the intended administrator-only capability check, effectively leaving an authentication-only gate. As a result, any authenticated user (e.g., a sub...

CVE-2026-15388 Cookie Consent < 0.0.10 - Subscriber+ Consent Settings Update and Consent Log Disclosure

The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST routes, so they fall back to an authentication-only gate, allowing any authenticated user such as a subscriber to update the Cookie Consent...

CVE-2026-15388

The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST routes, so they fall back to an authentication-only gate, allowing any authenticated user such as a subscriber to update the Cookie Consent...

CVE-2026-14859

The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated users such as Subscribers to create crowdfunding campaign posts despite not being granted that permission...

CVE-2026-14858

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate every order in the store...

EUVD-2026-57079

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate every order in the store...

EUVD-2026-57074

The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to create WordPress user accounts for arbitrary email addresses and inject order records...

EUVD-2026-57076

The KiviCare WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed, allowing authenticated patient-level users to read other patients' bills, invoices and appointment details...

CVE-2026-14857

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers, allowing any authenticated users such as Subscribers to alter other users' campaigns...

EUVD-2026-57075

The Eventin WordPress plugin before 4.1.20 does not properly restrict access to individual order records, allowing users with contributor-level access and above to read other customers' order data including personal information by iterating order identifiers...

CVE-2026-13612

The KiviCare WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed, allowing authenticated patient-level users to read other patients' bills, invoices and appointment details...

CVE-2026-12976

The LearnPress WordPress plugin before 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's lesson content, allowing any authenticated user such as a subscriber to obtain material from paid courses they have not enrolled in...

CVE-2026-13168

The Eventin WordPress plugin before 4.1.20 does not properly restrict access to stored customer records, allowing users with contributor-level access and above to read other customers' personal data such as names and email addresses...

EUVD-2026-57073

The Eventin WordPress plugin before 4.1.20 does not properly restrict access to stored customer records, allowing users with contributor-level access and above to read other customers' personal data such as names and email addresses...

CVE-2026-68448

In the Linux kernel, the following vulnerability has been resolved: ovl: check access to copyfilerange source with src mounter creds Commit 5dae222a5ff0c "vfs: allow copyfilerange to copy across devices" allowed filesystems that implement the copyfilerange fop to decide if they want to access...

DEBIAN-CVE-2026-68448

In the Linux kernel, the following vulnerability has been resolved: ovl: check access to copyfilerange source with src mounter creds Commit 5dae222a5ff0c "vfs: allow copyfilerange to copy across devices" allowed filesystems that implement the copyfilerange fop to decide if they want to access...

CVE-2026-68448

In the Linux kernel, the following vulnerability has been resolved: ovl: check access to copyfilerange source with src mounter creds Commit 5dae222a5ff0c "vfs: allow copyfilerange to copy across devices" allowed filesystems that implement the copyfilerange fop to decide if they want to access...

CVE-2026-68448

In the Linux kernel, the following vulnerability has been resolved: ovl: check access to copyfilerange source with src mounter creds Commit 5dae222a5ff0c "vfs: allow copyfilerange to copy across devices" allowed filesystems that implement the copyfilerange fop to decide if they want to access...