WordPress Plugin Vulnerabilities

Cookie Information < 2.0.8 - Reflected Cross-Site Scripting

Description

The plugin does not escape user data before outputting it back in attributes in the admin dashboard, leading to a Reflected Cross-Site Scripting issue

Proof of Concept

Affects Plugins

Plugin icon
wp-gdpr-compliance
Fixed in 2.0.8

References

CVE
CVE-2022-0147
URL
https://plugins.trac.wordpress.org/changeset/2681371

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
Krzysztof Zając
Submitter
Krzysztof Zając
Submitter website
https://kazet.cc/
Verified
Yes
WPVDB ID
2c735365-69c0-4652-b48e-c4a192dfe0d1

Timeline

Publicly Published
2022-02-21 (about 3 years ago)
Added
2022-02-21 (about 3 years ago)
Last Updated
2022-04-16 (about 3 years ago)

Other

Published
Title
Published
2023-09-08
Title
Simple Download Counter < 1.6.1 - Contributor+ Stored XSS
Published
2025-01-24
Title
FAQ Builder AYS < 1.7.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2025-03-11
Title
Another Events Calendar <= 1.7.0 - Reflected Cross-Site Scripting
Published
2024-06-11
Title
Sitetweet <= 0.2 - Stored XSS via CSRF
Published
2024-06-03
Title
Visual Composer Website Builder < 45.9.0 - Authenticated (Editor+) Stored Cross-Site Scripting