WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
gdpr-cookie-consent · plugin
Known security vulnerabilities for WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode. Find out in seconds which version runs on your site with WP Lens.
19 known vulnerabilities
2 critical · 11 exploitable without logging in · 1 with public exploit code · latest Sep 9, 2026
Listed on wordpress.org · latest 4.4.6 · last updated Sep 28, 2026 · 9K+ installs
wordpress.org status checked on Oct 2, 2026
Vulnerabilities
- Critical 10.0
CVE-2026-82970unauthenticated≤ 4.4.1
WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.1 - Arbitrary File Upload vulnerability
- Critical 9.8
CVE-2026-75865unauthenticated≤ 4.4.1
WPLP Cookie Consent <= 4.4.1 - Unauthenticated Arbitrary File Upload via 'upload-logo' REST Endpoint
- High 7.5
CVE-2025-11754unauthenticated≤ 4.1.2
Cookie Banner, Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) : WP Cookie Consent <= 4.1.2 - Missing Authorization to S
- High 7.2
CVE-2026-14989unauthenticated≤ 4.4.1
Cookie Banner for GDPR / CCPA <= 4.4.1 - Unauthenticated Stored Cross-Site Scripting via 'wpl_user_preference' Parameter
- High 7.2
CVE-2026-13360subscriber+≤ 4.3.5
Cookie Banner for GDPR / CCPA <= 4.3.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'regionArray' Parameter
- High 7.2
CVE-2023-23678high privilege≤ 2.2.5
WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent Plugin <= 2.2.5 is vulnerable to CSV Injection
- Medium 6.5
CVE-2026-73359subscriber+≤ 4.3.9
WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.3.9 - Cross Site Scripting (XSS) vulnerability
- Medium 6.1
CVE-2024-4869unauthenticated≤ 3.2.0
WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) <= 3.2.0 - Unauthenticated Stored Cross-Site Scripting via Client-IP header
- Medium 5.3
CVE-2025-66080unauthenticated≤ 4.0.3
WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.0.3 - Broken Access Control vulnerability
- Medium 5.3
CVE-2025-14061unauthenticated≤ 4.0.7
Cookie Banner, Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) : WP Cookie Consent <= 4.0.7 - Missing Authorization to U
- Medium 5.3
CVE-2025-66133unauthenticated≤ 4.0.7
WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.0.7 - Broken Access Control vulnerability
- Medium 5.3
CVE-2024-3599unauthenticated≤ 3.0.2
WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) <= 3.0.2 - Missing Authorization to Unauthenticated Arbitrary Post Deletion
- Medium 4.9
CVE-2026-14475admin≤ 4.3.6
Cookie Banner for GDPR / CCPA <= 4.3.6 - Authenticated (Administrator+) SQL Injection via 'scan_id' Parameter
- Medium 4.9
CVE-2026-12920admin≤ 4.3.5
Cookie Banner for GDPR / CCPA <= 4.3.5 - Authenticated (Administrator+) SQL Injection via 's' Parameter
- Medium 4.3
CVE-2026-15136unauthenticated · needs a click≤ 4.3.7
Cookie Banner for GDPR / CCPA – WPLP Cookie Consent <= 4.3.7 - Cross-Site Request Forgery via Bulk Action to Delete/Resolve Entries
- Medium 4.3
CVE-2025-49285unauthenticated · needs a click≤ 3.8.0
WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 3.8.0 - Cross Site Request Forgery (CSRF) Vulnerability
- Medium 4.3
CVE-2026-12955subscriber+≤ 4.3.6
Cookie Banner for GDPR / CCPA <= 4.3.6 - Missing Authorization to Authenticated (Subscriber+) Scan Schedule Modification via gcc_save_schedule_scan AJAX Action
- Medium 4.3
CVE-2025-66075login required≤ 4.0.3
WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.0.3 - Broken Access Control vulnerability
- Medium 4.3
CVE-2024-11724subscriber+≤ 3.6.5
Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) <= 3.6.5 - Missing Authorization to Authenticate
The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).