Wplegalpages
Monthly
Stored cross-site scripting in the WPLP Cookie Consent WordPress plugin (all versions ≤ 4.4.1) enables any unauthenticated site visitor to inject persistent malicious scripts via the `wpl_user_preference` AJAX parameter. The consent-logging endpoint is registered without authentication requirements, and the protective nonce (`wpl_consent_logging_nonce`) is publicly broadcast to every page visitor via `wp_localize_script()`, rendering the nonce mechanism entirely ineffective as an access barrier. Injected payloads execute in the browsers of administrators or users who subsequently view pages rendering consent log data, enabling session hijacking, credential theft, or full administrative account takeover. No public exploit is identified at time of analysis and the CVE is not listed in CISA KEV, but the trivially low exploitation barrier warrants prompt patching.
Unauthenticated arbitrary file upload in the WPLP Cookie Consent (GDPR/CCPA cookie banner) plugin for WordPress, versions up to and including 4.4.1, allows remote attackers to plant executable files on the server and potentially achieve remote code execution. The flaw stems from missing file-type validation in the saas_upload_logo() function combined with an authorization bypass on the WPLP connector REST endpoints, so no login is required. Reported by Wordfence and carrying a CVSS of 9.8; no public exploit identified at time of analysis.
Unauthenticated broken authentication in the WPLegalPages WordPress plugin (versions ≤ 3.7.0) allows remote attackers to bypass access controls on one or more plugin endpoints without any credentials or user interaction, as confirmed by the CVSS vector (AV:N/AC:L/PR:N/UI:N). The vulnerability is classified under CWE-288, meaning an alternate path or channel exists that circumvents the intended authentication gate. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, but the low attack complexity means opportunistic scanning is a realistic threat.
Stored XSS in the WPLP Cookie Consent WordPress plugin (all versions through 4.3.5) enables attackers to inject persistent JavaScript payloads via the unsanitized 'regionArray' parameter, executing in any visitor's browser on affected pages. The attack surface is compounded by a secondary flaw: the plugin's AJAX handler for Google Consent Mode (GCM) configuration performs no nonce verification and no capability check, permitting even Subscriber-level authenticated users to programmatically enable the GCM feature - the prerequisite for the XSS injection vector. No public exploit code or CISA KEV listing has been identified at time of analysis; a patch appears available in version 4.4.0 based on the WordPress plugin changeset reference.
Unauthenticated cross-site request forgery in the WPLP Cookie Consent WordPress plugin up to version 4.3.7 allows attackers to permanently delete or forcibly resolve arbitrary GDPR data request records stored in the wpl_data_req table. Exploitation requires tricking a site administrator into clicking a link, and while no active exploitation has been reported by CISA KEV, the flaw is confirmed with a fix committed to the plugin repository.
Unauthorized modification of cookie scan schedule configuration in the GDPR Cookie Consent WordPress plugin (versions up to 4.3.6) is achievable by any authenticated subscriber-level user. The vulnerability stems from a dual failure - absent capability check and absent nonce verification - on the wp_ajax_gcc_save_schedule_scan AJAX action, allowing low-privileged users to overwrite the gdpr_scan_schedule_data option that is administratively intended to require manage_options capability. No public exploit has been identified and the flaw is not listed in CISA KEV; a patched version (4.3.7) is available via the plugin's SVN repository.
SQL Injection in the Cookie Banner for GDPR/CCPA - WPLP Cookie Consent WordPress plugin (versions up to and including 4.3.6) enables authenticated administrators to append arbitrary SQL to existing queries via the unsanitized 'scan_id' parameter in the cookie scanner module. Exploitation is constrained to administrator-level accounts (PR:H per CVSS vector), making this a privileged read-only database extraction flaw rather than a broad remote attack surface. No public exploit code or CISA KEV listing has been identified at time of analysis; a patch commit is referenced in the WordPress plugin repository changeset.
SQL injection in the Cookie Banner for GDPR/CCPA - WPLP Cookie Consent WordPress plugin (all versions up to and including 4.3.5) enables authenticated administrators to append arbitrary SQL clauses to existing queries via the unescaped 's' search parameter in the admin data-request table interface. The vulnerable code spans at least four distinct query paths in class-wpl-data-req-table.php (lines 322, 377, 492, and 513), each failing to sanitize or properly prepare user-supplied input before use in database queries. No public exploit or CISA KEV listing has been identified at time of analysis; the high privilege requirement (WordPress administrator) substantially constrains real-world attack surface.
The WPLegalPages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wplegalpage' shortcode in versions up to, and including, 2.9.2 due to insufficient input sanitization and. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Stored cross-site scripting in the WPLP Cookie Consent WordPress plugin (all versions ≤ 4.4.1) enables any unauthenticated site visitor to inject persistent malicious scripts via the `wpl_user_preference` AJAX parameter. The consent-logging endpoint is registered without authentication requirements, and the protective nonce (`wpl_consent_logging_nonce`) is publicly broadcast to every page visitor via `wp_localize_script()`, rendering the nonce mechanism entirely ineffective as an access barrier. Injected payloads execute in the browsers of administrators or users who subsequently view pages rendering consent log data, enabling session hijacking, credential theft, or full administrative account takeover. No public exploit is identified at time of analysis and the CVE is not listed in CISA KEV, but the trivially low exploitation barrier warrants prompt patching.
Unauthenticated arbitrary file upload in the WPLP Cookie Consent (GDPR/CCPA cookie banner) plugin for WordPress, versions up to and including 4.4.1, allows remote attackers to plant executable files on the server and potentially achieve remote code execution. The flaw stems from missing file-type validation in the saas_upload_logo() function combined with an authorization bypass on the WPLP connector REST endpoints, so no login is required. Reported by Wordfence and carrying a CVSS of 9.8; no public exploit identified at time of analysis.
Unauthenticated broken authentication in the WPLegalPages WordPress plugin (versions ≤ 3.7.0) allows remote attackers to bypass access controls on one or more plugin endpoints without any credentials or user interaction, as confirmed by the CVSS vector (AV:N/AC:L/PR:N/UI:N). The vulnerability is classified under CWE-288, meaning an alternate path or channel exists that circumvents the intended authentication gate. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, but the low attack complexity means opportunistic scanning is a realistic threat.
Stored XSS in the WPLP Cookie Consent WordPress plugin (all versions through 4.3.5) enables attackers to inject persistent JavaScript payloads via the unsanitized 'regionArray' parameter, executing in any visitor's browser on affected pages. The attack surface is compounded by a secondary flaw: the plugin's AJAX handler for Google Consent Mode (GCM) configuration performs no nonce verification and no capability check, permitting even Subscriber-level authenticated users to programmatically enable the GCM feature - the prerequisite for the XSS injection vector. No public exploit code or CISA KEV listing has been identified at time of analysis; a patch appears available in version 4.4.0 based on the WordPress plugin changeset reference.
Unauthenticated cross-site request forgery in the WPLP Cookie Consent WordPress plugin up to version 4.3.7 allows attackers to permanently delete or forcibly resolve arbitrary GDPR data request records stored in the wpl_data_req table. Exploitation requires tricking a site administrator into clicking a link, and while no active exploitation has been reported by CISA KEV, the flaw is confirmed with a fix committed to the plugin repository.
Unauthorized modification of cookie scan schedule configuration in the GDPR Cookie Consent WordPress plugin (versions up to 4.3.6) is achievable by any authenticated subscriber-level user. The vulnerability stems from a dual failure - absent capability check and absent nonce verification - on the wp_ajax_gcc_save_schedule_scan AJAX action, allowing low-privileged users to overwrite the gdpr_scan_schedule_data option that is administratively intended to require manage_options capability. No public exploit has been identified and the flaw is not listed in CISA KEV; a patched version (4.3.7) is available via the plugin's SVN repository.
SQL Injection in the Cookie Banner for GDPR/CCPA - WPLP Cookie Consent WordPress plugin (versions up to and including 4.3.6) enables authenticated administrators to append arbitrary SQL to existing queries via the unsanitized 'scan_id' parameter in the cookie scanner module. Exploitation is constrained to administrator-level accounts (PR:H per CVSS vector), making this a privileged read-only database extraction flaw rather than a broad remote attack surface. No public exploit code or CISA KEV listing has been identified at time of analysis; a patch commit is referenced in the WordPress plugin repository changeset.
SQL injection in the Cookie Banner for GDPR/CCPA - WPLP Cookie Consent WordPress plugin (all versions up to and including 4.3.5) enables authenticated administrators to append arbitrary SQL clauses to existing queries via the unescaped 's' search parameter in the admin data-request table interface. The vulnerable code spans at least four distinct query paths in class-wpl-data-req-table.php (lines 322, 377, 492, and 513), each failing to sanitize or properly prepare user-supplied input before use in database queries. No public exploit or CISA KEV listing has been identified at time of analysis; the high privilege requirement (WordPress administrator) substantially constrains real-world attack surface.
The WPLegalPages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wplegalpage' shortcode in versions up to, and including, 2.9.2 due to insufficient input sanitization and. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.