32215 matches found
CVE-2026-85133
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on several of its settings AJAX actions, allowing any authenticated user, such as a subscriber, to read and destroy scan data belonging to the administrator and to overwrite the WPLP Cookie Consent...
CVE-2026-82185
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have capability or nonce checks on some of its A/B testing actions, allowing any authenticated user, such as a subscriber, to overwrite the cookie banner configuration shown to every visitor and to irreversibly reset the stored A/B te...
CVE-2026-82184
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have any authorisation or CSRF checks when storing visitor consent state, and the code that does so runs on every front-end page load, allowing unauthenticated attackers to overwrite a site-wide option with arbitrary data...
CVE-2026-85133 WPLP Cookie Consent < 4.4.2 - Subscriber+ Missing Authorization via Multiple Settings AJAX Actions
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on several of its settings AJAX actions, allowing any authenticated user, such as a subscriber, to read and destroy scan data belonging to the administrator and to overwrite the WPLP Cookie Consent...
WordPress WPLP Cookie Consent plugin < 4.4.2 - Subscriber+ Missing Authorization vulnerability
Subscriber+ Missing Authorization vulnerability discovered by Naoki Kawahigashi in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions 4.4.2...
CVE-2026-85133
The WPLP Cookie Consent WordPress plugin before 4.4.2 fails to perform nonce or capability checks on several settings AJAX actions. This allows any authenticated user with Subscriber-level access to read and destroy scan data belonging to the administrator and to overwrite the plugin's stored con...
EUVD-2026-74719
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on several of its settings AJAX actions, allowing any authenticated user, such as a subscriber, to read and destroy scan data belonging to the administrator and to overwrite the WPLP Cookie Consent...
EUVD-2026-74718
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on one of its cookie scanner AJAX actions, allowing any authenticated user, such as a subscriber, to read back the automated scan schedule the administrator configured...
CVE-2026-85132 WPLP Cookie Consent 4.0.2 - 4.4.1 - Subscriber+ Cookie Scan Schedule Disclosure via gcc_get_schedule_scan
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on one of its cookie scanner AJAX actions, allowing any authenticated user, such as a subscriber, to read back the automated scan schedule the administrator configured...
CVE-2026-85132
WPLP Cookie Consent WordPress plugin versions 4.0.2 through 4.4.1 fail to perform nonce or capability checks on the gcc_get_schedule_scan AJAX action. This allows any authenticated user at subscriber level or above to read back the automated cookie scan schedule configured by the administrator. T...
WordPress WPLP Cookie Consent plugin 4.0.2-4.4.1 - Subscriber+ Cookie Scan Schedule Disclosure vulnerability
Subscriber+ Cookie Scan Schedule Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions 4.0.2-4.4.1...
EUVD-2026-74711
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have capability or nonce checks on some of its A/B testing actions, allowing any authenticated user, such as a subscriber, to overwrite the cookie banner configuration shown to every visitor and to irreversibly reset the stored A/B te...
CVE-2026-82185 WPLP Cookie Consent < 4.4.2 - Subscriber+ Banner Settings Overwrite and A/B Test Data Reset
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have capability or nonce checks on some of its A/B testing actions, allowing any authenticated user, such as a subscriber, to overwrite the cookie banner configuration shown to every visitor and to irreversibly reset the stored A/B te...
CVE-2026-82185
CVE-2026-82185 affects the WPLP Cookie Consent WordPress plugin prior to version 4.4.2 . The root cause is missing capability or nonce checks on some of the plugin's A/B testing actions , allowing any authenticated user with a low-privilege role (such as a subscriber ) to overwrite the cookie ban...
WordPress WPLP Cookie Consent plugin < 4.4.2 - Subscriber+ Banner Settings Overwrite and A/B Test Data Reset vulnerability
Subscriber+ Banner Settings Overwrite and A/B Test Data Reset vulnerability discovered by RIA Labs in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions 4.4.2...
CVE-2026-82184 WPLP Cookie Consent < 4.4.2 - Unauthenticated IAB TCF Consent Option Update
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have any authorisation or CSRF checks when storing visitor consent state, and the code that does so runs on every front-end page load, allowing unauthenticated attackers to overwrite a site-wide option with arbitrary data...
WordPress WPLP Cookie Consent plugin < 4.4.2 - Unauthenticated IAB TCF Consent Option Update vulnerability
Unauthenticated IAB TCF Consent Option Update vulnerability discovered by Alex Spataru in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions 4.4.2...
CVE-2026-82184
The WPLP Cookie Consent WordPress plugin prior to 4.4.2 is missing both authorization and CSRF checks when storing the IAB TCF consent option . Because this code executes on every front-end page load, an unauthenticated attacker can overwrite this site-wide option with arbitrary data. The CVSS 3....
EUVD-2026-74710
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have any authorisation or CSRF checks when storing visitor consent state, and the code that does so runs on every front-end page load, allowing unauthenticated attackers to overwrite a site-wide option with arbitrary data...
Beautiful Cookie Consent Banner < 2.10.2 - Cross-Site Scripting
The Beautiful Cookie Consent Banner for WordPress is vulnerable to Stored Cross-Site Scripting via the 'nscbarcontenthref' parameter in versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...