CVE-2026-85130

The WPLP Cookie Consent WordPress plugin (versions before 4.4.4 ) contains an unauthenticated stored XSS vulnerability. The root cause is a failure to escape values submitted through a public endpoint before they are output in a JavaScript context on an administrative screen. This allows unauthen...

CVE-2026-92809

CVE-2026-92809 affects the PrestaShop psgdpr module (versions through 1.4.3 ). The vulnerability is an IDOR (Insecure Direct Object Reference) in GDPR consent logging: the module fails to validate that submitted consent log entries belong to the authenticated customer. An authenticated attacker c...

WordPress Cookie Consent plugin < 0.0.10 - Subscriber+ Consent Settings Update and Consent Log Disclosure vulnerability

Subscriber+ Consent Settings Update and Consent Log Disclosure vulnerability discovered by Shivamani Vastrala in WordPress Plugin Cookie Consent – GDPR & CCPA Cookie Banner & Consent Manager versions 0.0.10...

CVE-2026-15388

The Cookie Consent WordPress plugin (versions before 0.0.10 ) contains an authorization flaw where it fails to properly enforce administrator-only capability checks on its consent-settings REST routes . Instead, these routes fall back to a general authentication-only gate. This allows any authent...

CVE-2026-15388 Cookie Consent < 0.0.10 - Subscriber+ Consent Settings Update and Consent Log Disclosure

The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST routes, so they fall back to an authentication-only gate, allowing any authenticated user such as a subscriber to update the Cookie Consent...

WordPress webtoffee-cookie-consent plugin < 3.5.3 - Consent Log Disclosure/Deletion, Page Creation & License Deactivation vulnerability

Consent Log Disclosure/Deletion, Page Creation & License Deactivation vulnerability discovered by Eran Kapeluto in WordPress Plugin webtoffee-cookie-consent versions 3.5.3...