Wp Cookie Notice For Gdpr Ccpa Eprivacy Consent
Monthly
Unauthenticated cross-site scripting in the WP Cookie Notice for GDPR, CCPA & ePrivacy Consent WordPress plugin affects versions 4.4.6 and earlier, allowing remote attackers to inject script that executes in a victim's browser when that victim interacts with attacker-controlled input. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), no authentication is required and the attacker is remote, but exploitation is gated on user interaction - a site visitor or logged-in administrator must click a crafted link or submit a poisoned request that the plugin renders without proper sanitization; no victim action means no code execution. No public exploit code has been identified at time of analysis and the issue is not reported as actively exploited, so it should be treated as a moderate-severity, moderate-priority plugin hardening issue rather than an emergency, though the scope-change characteristic (S:C) means successful script execution can reach beyond the vulnerable component into the hosting WordPress site's origin.
Arbitrary file upload in the WP Legal Pages 'WP Cookie Notice for GDPR, CCPA & ePrivacy Consent' WordPress plugin (also distributed under the slug gdpr-cookie-consent) affects all versions from the initial release through 4.4.1, letting remote attackers upload files of dangerous types (e.g. PHP web shells) to the server. Because the plugin fails to restrict upload types (CWE-434), a successful upload typically yields remote code execution and full site compromise. Reported by Patchstack with a maximum CVSS of 10.0; there is no public exploit identified at time of analysis and no EPSS or KEV data supplied.
Stored Cross-Site Scripting in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent (≤4.3.9) is exploitable by any authenticated subscriber-level WordPress user, allowing injection of persistent JavaScript that executes when a higher-privileged user such as an administrator views the affected content. The scope-changed CVSS metric (S:C) reflects the real danger: a successful payload can hijack an admin session, modify site content, or silently escalate attacker privileges. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Unauthenticated cross-site scripting in the WP Cookie Notice for GDPR, CCPA & ePrivacy Consent WordPress plugin affects versions 4.4.6 and earlier, allowing remote attackers to inject script that executes in a victim's browser when that victim interacts with attacker-controlled input. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), no authentication is required and the attacker is remote, but exploitation is gated on user interaction - a site visitor or logged-in administrator must click a crafted link or submit a poisoned request that the plugin renders without proper sanitization; no victim action means no code execution. No public exploit code has been identified at time of analysis and the issue is not reported as actively exploited, so it should be treated as a moderate-severity, moderate-priority plugin hardening issue rather than an emergency, though the scope-change characteristic (S:C) means successful script execution can reach beyond the vulnerable component into the hosting WordPress site's origin.
Arbitrary file upload in the WP Legal Pages 'WP Cookie Notice for GDPR, CCPA & ePrivacy Consent' WordPress plugin (also distributed under the slug gdpr-cookie-consent) affects all versions from the initial release through 4.4.1, letting remote attackers upload files of dangerous types (e.g. PHP web shells) to the server. Because the plugin fails to restrict upload types (CWE-434), a successful upload typically yields remote code execution and full site compromise. Reported by Patchstack with a maximum CVSS of 10.0; there is no public exploit identified at time of analysis and no EPSS or KEV data supplied.
Stored Cross-Site Scripting in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent (≤4.3.9) is exploitable by any authenticated subscriber-level WordPress user, allowing injection of persistent JavaScript that executes when a higher-privileged user such as an administrator views the affected content. The scope-changed CVSS metric (S:C) reflects the real danger: a successful payload can hijack an admin session, modify site content, or silently escalate attacker privileges. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.