CVE-2026-85133

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on several of its settings AJAX actions, allowing any authenticated user, such as a subscriber, to read and destroy scan data belonging to the administrator and to overwrite the WPLP Cookie Consent...

CVE-2026-85132

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on one of its cookie scanner AJAX actions, allowing any authenticated user, such as a subscriber, to read back the automated scan schedule the administrator configured...

CVE-2026-82185

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have capability or nonce checks on some of its A/B testing actions, allowing any authenticated user, such as a subscriber, to overwrite the cookie banner configuration shown to every visitor and to irreversibly reset the stored A/B te...

CVE-2026-82184

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have any authorisation or CSRF checks when storing visitor consent state, and the code that does so runs on every front-end page load, allowing unauthenticated attackers to overwrite a site-wide option with arbitrary data...

Beautiful Cookie Consent Banner < 2.10.2 - Cross-Site Scripting

The Beautiful Cookie Consent Banner for WordPress is vulnerable to Stored Cross-Site Scripting via the 'nscbarcontenthref' parameter in versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

WordPress iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite vulnerability

Unauthenticated Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite vulnerability discovered by Pham Duc Anh in WordPress Plugin iubenda versions = 3.13.4...

CVE-2026-75865

CVE-2026-75865 — WPLP Cookie Consent gdpr-cookie-consent ≤ 4.4.1 Proof-of-concept and technical write-up for CVE-2026-75865 , an unauthenticated arbitrary file upload leading to remote code execution in the WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent...

CVE-2026-77263

The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent WordPress plugin is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) via comment content in all versions up to and including 3.13.4 . The root cause is insufficient input sanitization and output escaping: an attacke...

CVE-2026-77263 iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content

The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.13.4 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-77233 iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite

The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite in all versions up to, and including, 3.13.4 due to insufficient input sanitization and output escaping. This...

CVE-2026-82186

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks...

CVE-2026-82186

The WPLP Cookie Consent WordPress plugin (full name: WP Cookie Notice for GDPR, CCPA & ePrivacy Consent) in versions before 4.4.2 fails to properly validate the offset pagination parameter before using it in a SQL query, enabling users with administrator privileges to perform SQL injection . The ...

EUVD-2026-70909

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks...

CVE-2026-82186 WPLP Cookie Consent < 4.4.2 - Admin+ SQLi via 'offset' Parameter

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks...

WordPress WPLP Cookie Consent plugin < 4.4.2 - Admin+ SQLi vulnerability

Admin+ SQLi vulnerability discovered by cyberkareem in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions 4.4.2...

CVE-2026-75865

The WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the saasuploadlogo function combined with an authorization bypass on the WPLP connector REST endpoin...

CVE-2026-75865 WPLP Cookie Consent <= 4.4.1 - Unauthenticated Arbitrary File Upload via 'upload-logo' REST Endpoint

The WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the saasuploadlogo function combined with an authorization bypass on the WPLP connector REST endpoin...

EUVD-2026-68931

The WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the saasuploadlogo function combined with an authorization bypass on the WPLP connector REST endpoin...

CVE-2026-75865

WPLP Cookie Consent (a WordPress plugin for GDPR/CCPA consent management) is vulnerable to unauthenticated arbitrary file upload in all versions up to and including 4.4.1 . The root cause combines missing file type validation in the saas_upload_logo() function with an authorization bypass on the ...

PT-2026-84075

Name of the Vulnerable Software and Affected Versions WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode versions prior to 4.4.2 Description An arbitrary file upload issue exists due to missing file type validation in the saas upload logo function combin...