Cookie Consent
Monthly
Incorrect authorization in the Cookie Consent WordPress plugin (versions before 0.0.10) allows any authenticated user - including low-privilege roles such as subscribers - to overwrite the plugin's stored geolocation service license key via a REST API route that fails its intended administrator-only capability check and falls back to a weaker authentication-only gate. The practical consequence is silent disruption of geolocation-based consent banner targeting, which can undermine GDPR and regional cookie-consent compliance workflows. Publicly available exploit code exists (no confirmed CISA KEV listing), and an EPSS score of 17% indicates above-average real-world exploitation interest relative to this severity class.
Broken authorization in the Cookie Consent WordPress plugin before 0.0.10 allows any authenticated user - including a subscriber - to invoke administrator-intended REST API endpoints that control consent settings. Affected sites on the vendor's paid plan face an additional confidentiality exposure: the same misconfigured routes permit low-privileged users to read stored visitor consent logs, data that may carry GDPR compliance significance. A publicly available exploit exists, and an EPSS of 18% signals meaningful near-term exploitation probability despite the moderate CVSS score.
A persistent cross-site scripting vulnerability has been identified in the web interface of the Catapult UK Cookie Consent plugin before 2.3.10 for WordPress that allows the execution of arbitrary. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Incorrect authorization in the Cookie Consent WordPress plugin (versions before 0.0.10) allows any authenticated user - including low-privilege roles such as subscribers - to overwrite the plugin's stored geolocation service license key via a REST API route that fails its intended administrator-only capability check and falls back to a weaker authentication-only gate. The practical consequence is silent disruption of geolocation-based consent banner targeting, which can undermine GDPR and regional cookie-consent compliance workflows. Publicly available exploit code exists (no confirmed CISA KEV listing), and an EPSS score of 17% indicates above-average real-world exploitation interest relative to this severity class.
Broken authorization in the Cookie Consent WordPress plugin before 0.0.10 allows any authenticated user - including a subscriber - to invoke administrator-intended REST API endpoints that control consent settings. Affected sites on the vendor's paid plan face an additional confidentiality exposure: the same misconfigured routes permit low-privileged users to read stored visitor consent logs, data that may carry GDPR compliance significance. A publicly available exploit exists, and an EPSS of 18% signals meaningful near-term exploitation probability despite the moderate CVSS score.
A persistent cross-site scripting vulnerability has been identified in the web interface of the Catapult UK Cookie Consent plugin before 2.3.10 for WordPress that allows the execution of arbitrary. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.