CVE-2026-85132

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on one of its cookie scanner AJAX actions, allowing any authenticated user, such as a subscriber, to read back the automated scan schedule the administrator configured...

CVE-2026-85133

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on several of its settings AJAX actions, allowing any authenticated user, such as a subscriber, to read and destroy scan data belonging to the administrator and to overwrite the WPLP Cookie Consent...

CVE-2026-82185

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have capability or nonce checks on some of its A/B testing actions, allowing any authenticated user, such as a subscriber, to overwrite the cookie banner configuration shown to every visitor and to irreversibly reset the stored A/B te...

CVE-2026-82184

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have any authorisation or CSRF checks when storing visitor consent state, and the code that does so runs on every front-end page load, allowing unauthenticated attackers to overwrite a site-wide option with arbitrary data...

CVE-2026-85133 WPLP Cookie Consent < 4.4.2 - Subscriber+ Missing Authorization via Multiple Settings AJAX Actions

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on several of its settings AJAX actions, allowing any authenticated user, such as a subscriber, to read and destroy scan data belonging to the administrator and to overwrite the WPLP Cookie Consent...

WordPress WPLP Cookie Consent plugin < 4.4.2 - Subscriber+ Missing Authorization vulnerability

Subscriber+ Missing Authorization vulnerability discovered by Naoki Kawahigashi in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions 4.4.2...

CVE-2026-85133

The WPLP Cookie Consent WordPress plugin (versions before 4.4.2 ) is vulnerable to a Missing Authorization flaw. The plugin fails to perform nonce or capability checks on several of its settings AJAX actions . This allows any authenticated user, such as a subscriber , to perform unauthorized acti...

CVE-2026-85133 WPLP Cookie Consent < 4.4.2 - Subscriber+ Missing Authorization via Multiple Settings AJAX Actions

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on several of its settings AJAX actions, allowing any authenticated user, such as a subscriber, to read and destroy scan data belonging to the administrator and to overwrite the WPLP Cookie Consent...

EUVD-2026-74719

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on several of its settings AJAX actions, allowing any authenticated user, such as a subscriber, to read and destroy scan data belonging to the administrator and to overwrite the WPLP Cookie Consent...

EUVD-2026-74718

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on one of its cookie scanner AJAX actions, allowing any authenticated user, such as a subscriber, to read back the automated scan schedule the administrator configured...

CVE-2026-85132

The WPLP Cookie Consent WordPress plugin (versions 4.0.2-4.4.1 ) is vulnerable to a disclosure of the automated scan schedule. The root cause is a failure to perform nonce or capability checks on a specific cookie scanner AJAX action, specifically via gcc_get_schedule_scan. This allows any authen...

CVE-2026-85132 WPLP Cookie Consent 4.0.2 - 4.4.1 - Subscriber+ Cookie Scan Schedule Disclosure via gcc_get_schedule_scan

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on one of its cookie scanner AJAX actions, allowing any authenticated user, such as a subscriber, to read back the automated scan schedule the administrator configured...

WordPress WPLP Cookie Consent plugin 4.0.2-4.4.1 - Subscriber+ Cookie Scan Schedule Disclosure vulnerability

Subscriber+ Cookie Scan Schedule Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions 4.0.2-4.4.1...

CVE-2026-85132 WPLP Cookie Consent 4.0.2 - 4.4.1 - Subscriber+ Cookie Scan Schedule Disclosure via gcc_get_schedule_scan

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on one of its cookie scanner AJAX actions, allowing any authenticated user, such as a subscriber, to read back the automated scan schedule the administrator configured...

EUVD-2026-74711

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have capability or nonce checks on some of its A/B testing actions, allowing any authenticated user, such as a subscriber, to overwrite the cookie banner configuration shown to every visitor and to irreversibly reset the stored A/B te...

CVE-2026-82185 WPLP Cookie Consent < 4.4.2 - Subscriber+ Banner Settings Overwrite and A/B Test Data Reset

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have capability or nonce checks on some of its A/B testing actions, allowing any authenticated user, such as a subscriber, to overwrite the cookie banner configuration shown to every visitor and to irreversibly reset the stored A/B te...

CVE-2026-82185 WPLP Cookie Consent < 4.4.2 - Subscriber+ Banner Settings Overwrite and A/B Test Data Reset

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have capability or nonce checks on some of its A/B testing actions, allowing any authenticated user, such as a subscriber, to overwrite the cookie banner configuration shown to every visitor and to irreversibly reset the stored A/B te...

WordPress WPLP Cookie Consent plugin < 4.4.2 - Subscriber+ Banner Settings Overwrite and A/B Test Data Reset vulnerability

Subscriber+ Banner Settings Overwrite and A/B Test Data Reset vulnerability discovered by RIA Labs in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions 4.4.2...

CVE-2026-82185

The WPLP Cookie Consent WordPress plugin (versions before 4.4.2 ) is vulnerable to a lack of capability and nonce checks on specific A/B testing actions. This security flaw allows any authenticated user, including those with low-level permissions like a subscriber , to overwrite the cookie banner...

WordPress WPLP Cookie Consent plugin < 4.4.2 - Unauthenticated IAB TCF Consent Option Update vulnerability

Unauthenticated IAB TCF Consent Option Update vulnerability discovered by Alex Spataru in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions 4.4.2...