CVE-2026-92427

The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restrict access to the secret used to authenticate its payment gateway webhook, disclosing it to unauthenticated users and rendering the webhook's signature check ineffective. This allows unauthenticated attackers to forge...

CVE-2026-92427 Coinsnap Bitcoin Crowdfunding <= 1.2.0 - Unauthenticated Payment Record Forgery via Webhook Secret Disclosure

The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restrict access to the secret used to authenticate its payment gateway webhook, disclosing it to unauthenticated users and rendering the webhook's signature check ineffective. This allows unauthenticated attackers to forge...

CVE-2026-92427

The Coinsnap Bitcoin Crowdfunding WordPress plugin (versions through 1.2.0 ) is vulnerable to an unauthenticated payment record forgery. The root cause is a failure to restrict access to the secret used for authenticating the payment gateway webhook, which is disclosed to unauthenticated users. T...

EUVD-2026-102685

The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restrict access to the secret used to authenticate its payment gateway webhook, disclosing it to unauthenticated users and rendering the webhook's signature check ineffective. This allows unauthenticated attackers to forge...

WordPress Coinsnap Bitcoin Crowdfunding plugin <= 1.2.0 - Unauthenticated Payment Record Forgery vulnerability

Unauthenticated Payment Record Forgery vulnerability discovered by Pedro Pinho in WordPress Plugin Coinsnap Bitcoin Crowdfunding versions = 1.2.0...

CVE-2026-92427 Coinsnap Bitcoin Crowdfunding <= 1.2.0 - Unauthenticated Payment Record Forgery via Webhook Secret Disclosure

The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restrict access to the secret used to authenticate its payment gateway webhook, disclosing it to unauthenticated users and rendering the webhook's signature check ineffective. This allows unauthenticated attackers to forge...

PT-2026-115482

Name of the Vulnerable Software and Affected Versions Coinsnap Bitcoin Crowdfunding WordPress plugin versions prior to 1.2.1 Description The plugin fails to restrict access to the secret used to authenticate its payment gateway webhook, allowing unauthenticated users to obtain it. This disclosure...

CVE-2026-92427: Exposure of Sensitive Information to an Unauthorized Actor

The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restrict access to the secret used to authenticate its payment gateway webhook, disclosing it to unauthenticated users and rendering the webhook's signature check ineffective. This allows unauthenticated attackers to forge...

WordPress WP Crowdfunding plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by John Ryan Albon in WordPress Plugin WP Crowdfunding versions = 2.2.2...

WordPress WP Crowdfunding plugin <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Crowdfunding versions = 2.2.1...

CVE-2026-19945

The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-19945 WP Crowdfunding <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' Parameter

The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-19945

The WP Crowdfunding plugin for WordPress is vulnerable to stored cross-site scripting (XSS) via the first_name parameter in all versions up to and including 2.2.1 , caused by insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access or above can i...

EUVD-2026-74624

The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-19945 WP Crowdfunding <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' Parameter

The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-19944

The WP Crowdfunding plugin for WordPress is vulnerable to generic SQL Injection via 'wpneoreward' Post Meta in all versions up to, and including, 2.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2026-19944 WP Crowdfunding <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection via 'wpneo_reward' Post Meta

The WP Crowdfunding plugin for WordPress is vulnerable to generic SQL Injection via 'wpneoreward' Post Meta in all versions up to, and including, 2.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

EUVD-2026-74607

The WP Crowdfunding plugin for WordPress is vulnerable to generic SQL Injection via 'wpneoreward' Post Meta in all versions up to, and including, 2.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2026-19944

WP Crowdfunding for WordPress (versions up to and including 2.2.1 ) contains a second-order SQL injection in the wpneo_reward Post Meta field, caused by insufficient escaping and lack of prepared statements. An authenticated attacker with Shop Manager or higher privileges can inject a malicious p...

CVE-2026-19944 WP Crowdfunding <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection via 'wpneo_reward' Post Meta

The WP Crowdfunding plugin for WordPress is vulnerable to generic SQL Injection via 'wpneoreward' Post Meta in all versions up to, and including, 2.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...