WordPress Plugin Vulnerabilities

Cookie Notice & Consent < 1.6.6 - Unauthenticated Stored Cross-Site Scripting

Description

The Cookie Notice & Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the uuid parameter in all versions up to, and including, 1.6.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
cookie-notice-consent
Fixed in 1.6.6

References

CVE
CVE-2025-10496
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/035097dd-8ebd-49b8-93ea-0f957594f130

Classification

Type
CROSS FRAME SCRIPTING
OWASP top 10
A1: Injection
CWE
CWE-80
CVSS
7.2 (high)

Miscellaneous

Original Researcher
Muhammad Yudha - DJ
Verified
No
WPVDB ID
156e7425-610e-4e34-b420-5dfe4fe0f7e9

Timeline

Publicly Published
2025-10-08 (about 11 months ago)
Added
2025-10-08 (about 11 months ago)
Last Updated
2025-10-09 (about 11 months ago)

Other

Published
Title
Published
2024-02-28
Title
Events Manager < 6.4.7 - Authenticated(Administator+) Stored Cross-Site Scripting via settings
Published
2024-02-14
Title
Simple Share Buttons Adder < 8.4.12 - Authenticated(Administrator+) Stored Cross-Site Scripting via CSS Settings
Published
2024-02-07
Title
Elementor Website Builder – More than Just a Page Builder < 3.19.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via get_image_alt
Published
2024-05-08
Title
Enter Addons < 2.1.6 - Contributor+ Stored XSS via Heading widget
Published
2024-01-22
Title
Content Views < 3.6.3 - Admin+ Stored XSS