CVE-2026-112066

The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website...

CVE-2026-112065 Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)

The routes that provide consent history and statistics data did not check whether the backend user had access to the module or to the requested page. Any authenticated backend user, regardless of permissions, could therefore retrieve consent data of any site in the installation...

CVE-2026-112065

The sgalinski Cookie Consent extension (sg_cookie_optin ) is vulnerable to a Missing Authorization (CWE-862) flaw. Specifically, the routes providing consent history and statistics data fail to verify if the authenticated backend user has the necessary permissions to access the module or the requ...

CVE-2026-112066 Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)

The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website...

EUVD-2026-104873

The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website...

CVE-2026-112064 SQL Injection in extension "sgalinski Cookie Consent" (sg_cookie_optin)

The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation. Only the filter conditions of that query were bound as parameters. A backend user with access to the history or statistics...

CVE-2026-112064

The sgalinski Cookie Consent (sg_cookie_optin) extension is vulnerable to SQL Injection due to a lack of input validation. The backend module's history and statistics functions accept sorting, grouping, and index options from requests and include them in database queries without proper validation...

CVE-2026-112066

The sgalinski Cookie Consent (sg_cookie_optin) extension is vulnerable to a Missing Authorization flaw during the JSON import of cookie consent configurations. Specifically, the import process fails to validate the backend user's permissions, allowing non-admin backend users with module access to...

TYPO3-EXT-SA-2026-029: Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-029...

TYPO3-EXT-SA-2026-029: SQL Injection in extension "sgalinski Cookie Consent" (sg_cookie_optin)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-029...

TYPO3-EXT-SA-2026-029: Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-029...

Beautiful Cookie Consent Banner < 2.10.2 - Cross-Site Scripting

The Beautiful Cookie Consent Banner for WordPress is vulnerable to Stored Cross-Site Scripting via the 'nscbarcontenthref' parameter in versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

PT-2026-118303

The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website...

CVE-2026-75865

CVE-2026-75865 — WPLP Cookie Consent gdpr-cookie-consent ≤ 4.4.1 Proof-of-concept and technical write-up for CVE-2026-75865 , an unauthenticated arbitrary file upload leading to remote code execution in the WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent...

EUVD-2026-102667

The Lightweight Cookie Notice – Cookie Banner for Cookie Consent plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.19 This is due to the W3TCDYNAMICSECURITY constant being hardcoded to a publicly known value. This makes it possible for...

CVE-2026-97339

The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter in all versions up to, and including, 7.5.5 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-102614

The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter in all versions up to, and including, 7.5.5 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-97339 Complianz GDPR/CCPA Cookie Consent Banner <= 7.5.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter

The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter in all versions up to, and including, 7.5.5 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-97339

The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 7.5.5 . The root cause is insufficient input sanitization and output escaping within the yotu-wp Cookie-Blocker Filter . An unauthenticated att...

WordPress Complianz GDPR/CCPA Cookie Consent Banner plugin <= 7.5.5 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin Complianz versions = 7.5.5...