CVE-2026-14359

The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.35.0. This is due to the adduserinwaitinglist function registered on the wpajaxyithwcwtladduser action being missing both a capability check and a nonce verificatio...

EUVD-2026-74774

The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.35.0. This is due to the adduserinwaitinglist function registered on the wpajaxyithwcwtladduser action being missing both a capability check and a nonce verificatio...

CVE-2026-14359

The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 3.35.0 . The root cause is the add_user_in_waiting_list() function, registered on the wp_ajax_yith_wcwtl_add_user action, which lacks both a capability check and nonce ...

CVE-2026-14359 YITH WooCommerce Waitlist Premium <= 3.35.0 - Authenticated (Subscriber+) Privilege Escalation to Admin via wp_ajax_yith_wcwtl_add_user

The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.35.0. This is due to the adduserinwaitinglist function registered on the wpajaxyithwcwtladduser action being missing both a capability check and a nonce verificatio...

CVE-2026-85132

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on one of its cookie scanner AJAX actions, allowing any authenticated user, such as a subscriber, to read back the automated scan schedule the administrator configured...

CVE-2026-8615

The Reviso Exporter for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the disconnectcallback function in versions up to, and including, 1.2.3. The function is registered to the...

CVE-2026-85133

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on several of its settings AJAX actions, allowing any authenticated user, such as a subscriber, to read and destroy scan data belonging to the administrator and to overwrite the WPLP Cookie Consent...

CVE-2026-82185

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have capability or nonce checks on some of its A/B testing actions, allowing any authenticated user, such as a subscriber, to overwrite the cookie banner configuration shown to every visitor and to irreversibly reset the stored A/B te...

CVE-2026-85132 WPLP Cookie Consent 4.0.2 - 4.4.1 - Subscriber+ Cookie Scan Schedule Disclosure via gcc_get_schedule_scan

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on one of its cookie scanner AJAX actions, allowing any authenticated user, such as a subscriber, to read back the automated scan schedule the administrator configured...

CVE-2026-85132

The WPLP Cookie Consent WordPress plugin (versions 4.0.2-4.4.1 ) is vulnerable to a disclosure of the automated scan schedule. The root cause is a failure to perform nonce or capability checks on a specific cookie scanner AJAX action, specifically via gcc_get_schedule_scan. This allows any authen...

EUVD-2026-74711

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have capability or nonce checks on some of its A/B testing actions, allowing any authenticated user, such as a subscriber, to overwrite the cookie banner configuration shown to every visitor and to irreversibly reset the stored A/B te...

CVE-2026-82185 WPLP Cookie Consent < 4.4.2 - Subscriber+ Banner Settings Overwrite and A/B Test Data Reset

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have capability or nonce checks on some of its A/B testing actions, allowing any authenticated user, such as a subscriber, to overwrite the cookie banner configuration shown to every visitor and to irreversibly reset the stored A/B te...

EUVD-2026-74690

The Reviso Exporter for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the disconnectcallback function in versions up to, and including, 1.2.3. The function is registered to the...

CVE-2026-8615 ilGhera Reviso Exporter for WooCommerce <= 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Agreement Grant Token Deletion via disconnect_callback Function

The Reviso Exporter for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the disconnectcallback function in versions up to, and including, 1.2.3. The function is registered to the...

PT-2026-89265

Name of the Vulnerable Software and Affected Versions Builderall Cheetah For Wp versions prior to 3.0.3 Description Unauthorized modification of data is possible due to a missing capability check in the disable function. The wp ajax ba cheetah disable AJAX handler is registered without capability...

PT-2026-88896

The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.35.0. This is due to the add user in waiting list function registered on the wp ajax yith wcwtl add user action being missing both a capability check and a nonce...

PT-2026-88876

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on several of its settings AJAX actions, allowing any authenticated user, such as a subscriber, to read and destroy scan data belonging to the administrator and to overwrite the WPLP Cookie Consent...

PT-2026-88875

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on one of its cookie scanner AJAX actions, allowing any authenticated user, such as a subscriber, to read back the automated scan schedule the administrator configured...

VulnCheck KEV: CVE-2026-14359

The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.35.0. This is due to the adduserinwaitinglist function registered on the wpajaxyithwcwtladduser action being missing both a capability check and a nonce verificatio...

CVE-2026-8615: Missing Authorization

The Reviso Exporter for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the disconnectcallback function in versions up to, and including, 1.2.3. The function is registered to the...