Cookie Notice & Consent Banner for GDPR & CCPA Compliance < 1.7.2 – Admin+ Stored XSS | CVE 2021-24590

Description

The plugin does not properly sanitize inputs to prevent injection of arbitrary HTML within the plugin's design customization options.

Proof of Concept

Go to the plugin's Customize Design page and open the "Wizard menu". Now scroll down and you will find an "Info Text" field where you can inject an XSS payload like "<details open ontoggle=confirm()>". Click "Publish" to store the payload.

Affects Plugins

cookie-notice-and-consent-banner

Fixed in 1.7.2

References

CVE

CVE-2021-24590

URL

https://www.hackpertise.com/cve/8-cve-2021-24590/

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CWE-79

CVSS

2.4 (low)

Miscellaneous

Original Researcher

Asif Nawaz Minhas

Submitter

Asif Nawaz Minhas

Verified

Yes

WPVDB ID

d6846774-1958-4c8d-bb64-af0d8c46e6e7

Timeline

Publicly Published

2021-08-06 (about 4 years ago)

Added

2021-08-06 (about 4 years ago)

Last Updated

2023-04-12 (about 2 years ago)

Other

Published

Title

Published

2025-09-03

Title

Latest Post Shortcode < 14.10 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2025-12-05

Title

List Attachments Shortcode <= 0.4.1a - Authenticated (Author+) Stored Cross-Site Scripting via list-attachments Shortcode

Published

2025-01-16

Title

ePermissions <= 1.2 - Reflected Cross-Site Scripting

Published

2024-12-19

Title

aklamator-infeed <= 2.0.0 - Admin+ Stored XSS

Published

2025-07-04

Title

OwnerRez < 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting