CVE-2026-18046 Cookie Consent < 0.0.10 - Subscriber+ MaxMind License Key Update

The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on the REST route that stores its geolocation service license key, so the route falls back to an authentication-only gate, allowing any authenticated user such as a...

CVE-2026-18046 Cookie Consent < 0.0.10 - Subscriber+ MaxMind License Key Update

The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on the REST route that stores its geolocation service license key, so the route falls back to an authentication-only gate, allowing any authenticated user such as a...

EUVD-2026-57094

The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on the REST route that stores its geolocation service license key, so the route falls back to an authentication-only gate, allowing any authenticated user such as a...

EUVD-2026-57084

The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST routes, so they fall back to an authentication-only gate, allowing any authenticated user such as a subscriber to update the Cookie Consent...

CVE-2026-15388

The Cookie Consent WordPress plugin (versions before 0.0.10 ) contains an authorization flaw where it fails to properly enforce administrator-only capability checks on its consent-settings REST routes . Instead, these routes fall back to a general authentication-only gate. This allows any authent...

CVE-2026-15388 Cookie Consent < 0.0.10 - Subscriber+ Consent Settings Update and Consent Log Disclosure

The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST routes, so they fall back to an authentication-only gate, allowing any authenticated user such as a subscriber to update the Cookie Consent...

CVE-2026-15388

The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST routes, so they fall back to an authentication-only gate, allowing any authenticated user such as a subscriber to update the Cookie Consent...

CVE-2026-15388 Cookie Consent < 0.0.10 - Subscriber+ Consent Settings Update and Consent Log Disclosure

The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST routes, so they fall back to an authentication-only gate, allowing any authenticated user such as a subscriber to update the Cookie Consent...

CVE-2026-18046: Incorrect Authorization

The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on the REST route that stores its geolocation service license key, so the route falls back to an authentication-only gate, allowing any authenticated user such as a...

CVE-2026-18057: Improper Neutralization of Special Elements used in an SQL Command

The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using it in a SQL statement, allowing users with a subscriber account and above to perform SQL injection attacks and tamper with booking consent records belonging to other people...

CVE-2026-15388: Incorrect Authorization

The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST routes, so they fall back to an authentication-only gate, allowing any authenticated user such as a subscriber to update the Cookie Consent...

PT-2026-71009

The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST routes, so they fall back to an authentication-only gate, allowing any authenticated user such as a subscriber to update the Cookie Consent...

PT-2026-71022

The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using it in a SQL statement, allowing users with a subscriber account and above to perform SQL injection attacks and tamper with booking consent records belonging to other people...

PT-2026-71019

The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on the REST route that stores its geolocation service license key, so the route falls back to an authentication-only gate, allowing any authenticated user such as a...

CVE-2026-47364

In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no user-facing opt-out. Impact: The Datadog user UUID and crash data are visible within Firebase Crashlytics. This UUID is not identifying outside Datadog's own...

CVE-2026-47364

In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no user-facing opt-out. Impact: The Datadog user UUID and crash data are visible within Firebase Crashlytics. This UUID is not identifying outside Datadog's own...

MAL-2026-13504 Malicious code in dolyame-ui-attachfile (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94c62279c3082872b3757ea65632b6597ee90018e96a3eb6f038f3865db9e7d8 On require of the package's main entry, index.js loads./lib/telemetry and./shim. Both modules implement an import-time dropper: they select a...

WordPress webtoffee-cookie-consent plugin < 3.5.3 - Consent Log Disclosure/Deletion, Page Creation & License Deactivation vulnerability

Consent Log Disclosure/Deletion, Page Creation & License Deactivation vulnerability discovered by Eran Kapeluto in WordPress Plugin webtoffee-cookie-consent versions 3.5.3...

Malicious code in dolyame-boxy-mobile-bnpl-text-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e5ba9319e9ab791d3944f19baaae57aac3c2d381bf03ccf736d8ae09a2ba4b6 On any require of the package, index.js loads./compat.js, which fetches a native binary from string-fragmented Cloudflare Workers hosts under...

Malicious code in bnpl-blocks-atom-bnpl-email-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4990414fbbea6c3a7c19539ac76eeee019ae4657756545743b4b54bdece4a135 Requiring the package's main entry transitively loads init.js, which selects an OS/architecture-specific endpoint and downloads a binary from one of...