Wp Legal Pages
Monthly
Arbitrary file upload in the WP Legal Pages 'WP Cookie Notice for GDPR, CCPA & ePrivacy Consent' WordPress plugin (also distributed under the slug gdpr-cookie-consent) affects all versions from the initial release through 4.4.1, letting remote attackers upload files of dangerous types (e.g. PHP web shells) to the server. Because the plugin fails to restrict upload types (CWE-434), a successful upload typically yields remote code execution and full site compromise. Reported by Patchstack with a maximum CVSS of 10.0; there is no public exploit identified at time of analysis and no EPSS or KEV data supplied.
Unauthenticated broken authentication in the WPLegalPages WordPress plugin (versions ≤ 3.7.0) allows remote attackers to bypass access controls on one or more plugin endpoints without any credentials or user interaction, as confirmed by the CVSS vector (AV:N/AC:L/PR:N/UI:N). The vulnerability is classified under CWE-288, meaning an alternate path or channel exists that circumvents the intended authentication gate. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, but the low attack complexity means opportunistic scanning is a realistic threat.
Stored Cross-Site Scripting in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent (≤4.3.9) is exploitable by any authenticated subscriber-level WordPress user, allowing injection of persistent JavaScript that executes when a higher-privileged user such as an administrator views the affected content. The scope-changed CVSS metric (S:C) reflects the real danger: a successful payload can hijack an admin session, modify site content, or silently escalate attacker privileges. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Arbitrary file upload in the WP Legal Pages 'WP Cookie Notice for GDPR, CCPA & ePrivacy Consent' WordPress plugin (also distributed under the slug gdpr-cookie-consent) affects all versions from the initial release through 4.4.1, letting remote attackers upload files of dangerous types (e.g. PHP web shells) to the server. Because the plugin fails to restrict upload types (CWE-434), a successful upload typically yields remote code execution and full site compromise. Reported by Patchstack with a maximum CVSS of 10.0; there is no public exploit identified at time of analysis and no EPSS or KEV data supplied.
Unauthenticated broken authentication in the WPLegalPages WordPress plugin (versions ≤ 3.7.0) allows remote attackers to bypass access controls on one or more plugin endpoints without any credentials or user interaction, as confirmed by the CVSS vector (AV:N/AC:L/PR:N/UI:N). The vulnerability is classified under CWE-288, meaning an alternate path or channel exists that circumvents the intended authentication gate. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, but the low attack complexity means opportunistic scanning is a realistic threat.
Stored Cross-Site Scripting in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent (≤4.3.9) is exploitable by any authenticated subscriber-level WordPress user, allowing injection of persistent JavaScript that executes when a higher-privileged user such as an administrator views the affected content. The scope-changed CVSS metric (S:C) reflects the real danger: a successful payload can hijack an admin session, modify site content, or silently escalate attacker privileges. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.