What’s Vulnerable › Vulnerabilities
CVE-2024-8397: GDPR Cookie Consent <= 2.6.0 - Unauthenticated Stored XSS
- Severity: medium (CVSS 5.4 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2025-05-15 · updated 2026-06-17
- Weakness: CWE-79
Description
The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not properly sanitize and escape the IP headers when logging them, allowing visitors to conduct Stored Cross-Site Scripting attacks. The payload gets triggered when an admin visits the 'Consent report' page and the malicious script is executed in the admin context.
Affected products
- webtoffee-gdpr-cookie-consent: before 2.61 — fixed in 2.61
How to fix
Upgrade to a fixed version: webtoffee-gdpr-cookie-consent 2.61. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-8397 or the next vulnerability affects your stack