What’s Vulnerable › Products
wplegalpages Cookie Banner for GDPR / CCPA – WPLP Cookie Consent vulnerabilities
10 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.
Latest wplegalpages Cookie Banner for GDPR / CCPA – WPLP Cookie Consent vulnerabilities
- CVE-2026-14475 — Cookie Banner for GDPR / CCPA <= 4.3.6 - Authenticated (Administrator+) SQL Injection via 'scan_id' Parameter (CVSS 4.9)
- CVE-2026-12955 — Cookie Banner for GDPR / CCPA <= 4.3.6 - Missing Authorization to Authenticated (Subscriber+) Scan Schedule Modification via gcc_save_schedule_scan AJAX Action (CVSS 4.3)
- CVE-2026-12920 — Cookie Banner for GDPR / CCPA <= 4.3.5 - Authenticated (Administrator+) SQL Injection via 's' Parameter (CVSS 4.9)
- CVE-2025-11754 — Cookie Banner, Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) : WP Cookie Consent <= 4.1.2 - Missing Authorization to Sensitive Information Exposure (CVSS 7.5)
- CVE-2025-14061 — Cookie Banner, Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) : WP Cookie Consent <= 4.0.7 - Missing Authorization to Unauthenticated Arbitrary Post Deletion (CVSS 5.3)
- CVE-2024-11724 — Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) <= 3.6.5 - Missing Authorization to Authenticated (Subscriber+) Whitelist Script (CVSS 4.3)
- CVE-2022-4974 — Freemius SDK <= 2.4.2 - Missing Authorization Checks (CVSS 6.3)
- CVE-2024-4869 — WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) <= 3.2.0 - Unauthenticated Stored Cross-Site Scripting via Client-IP header (CVSS 6.1)
- CVE-2024-3599 — WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) <= 3.0.2 - Missing Authorization to Unauthenticated Arbitrary Post Deletion (CVSS 5.3)
- CVE-2023-23678 — WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent Plugin <= 2.2.5 is vulnerable to CSV Injection (CVSS 7.2)