Plugin icon

WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode

gdpr-cookie-consent

Vulnerabilities:

26

Last Updated:

October 12, 2026

Active Installs:

9000

Published
Title
Fixed in
CVSS
Published
2026-10-05
Title
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode < 4.4.7 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 4.4.7
CVSS
7.2 (high)
Published
2026-09-15
Title
WPLP Cookie Consent < 4.4.4 - Unauthenticated Stored XSS via Consent Logs
Fixed in
Fixed in 4.4.4
CVSS
8.8 (high)
Published
2026-09-14
Title
WPLP Cookie Consent < 4.4.4 - Arbitrary Post Deletion via CSRF
Fixed in
Fixed in 4.4.4
CVSS
6.5 (medium)
Published
2026-09-08
Title
Cookie Banner for GDPR / CCPA < 4.4.2 - Unauthenticated Stored Cross-Site Scripting via 'wpl_user_preference' Parameter
Fixed in
Fixed in 4.4.2
CVSS
7.2 (high)
Published
2026-09-07
Title
WPLP Cookie Consent < 4.4.2 - Unauthenticated IAB TCF Consent Option Update
Fixed in
Fixed in 4.4.2
CVSS
5.3 (medium)
Published
2026-09-07
Title
WPLP Cookie Consent < 4.4.2 - Subscriber+ Missing Authorization via Multiple Settings AJAX Actions
Fixed in
Fixed in 4.4.2
CVSS
5.4 (medium)
Published
2026-09-07
Title
WPLP Cookie Consent < 4.4.2 - Subscriber+ Banner Settings Overwrite and A/B Test Data Reset
Fixed in
Fixed in 4.4.2
CVSS
4.3 (medium)
Published
2026-09-07
Title
WPLP Cookie Consent 4.0.2 - 4.4.1 - Subscriber+ Cookie Scan Schedule Disclosure via gcc_get_schedule_scan
Fixed in
Fixed in 4.4.2
CVSS
4.3 (medium)
Published
2026-09-02
Title
WPLP Cookie Consent < 4.4.2 - Admin+ SQLi via 'offset' Parameter
Fixed in
Fixed in 4.4.2
CVSS
4.1 (medium)
Published
2026-08-31
Title
WPLP Cookie Consent < 4.4.2 - Unauthenticated Arbitrary File Upload via 'upload-logo' REST Endpoint
Fixed in
Fixed in 4.4.2
CVSS
9.8 (critical)
Published
2026-08-31
Title
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode < 4.4.2 - Unauthenticated Arbitrary File Upload
Fixed in
Fixed in 4.4.2
CVSS
9.8 (critical)
Published
2026-08-18
Title
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode < 4.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Fixed in
Fixed in 4.4.0
CVSS
6.4 (medium)
Published
2026-08-14
Title
Cookie Banner for GDPR / CCPA < 4.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'regionArray' Parameter
Fixed in
Fixed in 4.4.0
CVSS
6.4 (medium)
Published
2026-07-27
Title
Cookie Banner for GDPR / CCPA – WPLP Cookie Consent < 4.3.8 - Cross-Site Request Forgery via Bulk Action to Delete/Resolve Entries
Fixed in
Fixed in 4.3.8
CVSS
4.3 (medium)
Published
2026-07-09
Title
Cookie Banner for GDPR / CCPA < 4.3.7 - Authenticated (Administrator+) SQL Injection via 'scan_id' Parameter
Fixed in
Fixed in 4.3.7
CVSS
4.9 (medium)
Published
2026-07-09
Title
Cookie Banner for GDPR / CCPA < 4.3.7 - Missing Authorization to Authenticated (Subscriber+) Scan Schedule Modification via gcc_save_schedule_scan AJAX Action
Fixed in
Fixed in 4.3.7
CVSS
4.3 (medium)
Published
2026-07-02
Title
Cookie Banner for GDPR / CCPA < 4.3.6 - Authenticated (Administrator+) SQL Injection via 's' Parameter
Fixed in
Fixed in 4.3.6
CVSS
4.9 (medium)
Published
2026-02-18
Title
Cookie Banner, Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) : WP Cookie Consent < 4.1.3 - Missing Authorization to Sensitive Information Exposure
Fixed in
Fixed in 4.1.3
CVSS
7.5 (high)
Published
2025-12-30
Title
Cookie Notice for GDPR, CCPA & ePrivacy Consent < 4.0.4 - Missing Authorization
Fixed in
Fixed in 4.0.4
CVSS
5.3 (medium)
Published
2025-12-16
Title
Cookie Banner, Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) : WP Cookie Consent < 4.0.8 - Missing Authorization to Unauthenticated Arbitrary Post Deletion
Fixed in
Fixed in 4.0.8
CVSS
5.3 (medium)
Published
2025-12-15
Title
Cookie Notice for GDPR, CCPA & ePrivacy Consent < 4.0.8 - Missing Authorization
Fixed in
Fixed in 4.0.8
CVSS
5.3 (medium)
Published
2025-11-08
Title
Cookie Notice for GDPR, CCPA & ePrivacy Consent < 4.0.4 - Missing Authorization
Fixed in
Fixed in 4.0.4
CVSS
4.3 (medium)
Published
2025-06-05
Title
WP Cookie Notice for GDPR, CCPA & ePrivacy Consent < 3.8.1 - Cross-Site Request Forgery
Fixed in
Fixed in 3.8.1
CVSS
4.3 (medium)
Published
2024-12-11
Title
Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) < 3.6.6 - Missing Authorization to Authenticated (Subscriber+) Whitelist Script
Fixed in
Fixed in 3.6.6
CVSS
4.3 (medium)
Published
2024-06-25
Title
WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) < 3.3.0 - Unauthenticated Stored Cross-Site Scripting via Client-IP header
Fixed in
Fixed in 3.3.0
CVSS
7.2 (high)
Published
2024-04-16
Title
WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) < 3.1.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletion
Fixed in
Fixed in 3.1.0
CVSS
5.3 (medium)