CVE-2022-45815

Cross-Site Request Forgery CSRF vulnerability in StylemixThemes GDPR Compliance & Cookie Consent plugin = 1.2 versions...

CVE-2021-24590

The Cookie Notice & Consent Banner for GDPR & CCPA Compliance WordPress plugin before 1.7.2 does not properly sanitize inputs to prevent injection of arbitrary HTML within the plugin's design customization options...

CVE-2021-24569

The Cookie Notice & Compliance for GDPR / CCPA WordPress plugin before 2.1.2 does not escape the value of its Button Text setting when outputting it in an attribute in the frontend, allowing high privilege users such as admin to perform Cross-Site Scripting even when the unfilteredhtml capability...

CVE-2020-20633

ajaxpolicygenerator in admin/modules/cli-policy-generator/classes/class-policy-generator-ajax.php in GDPR Cookie Consent cookie-law-info 1.8.2 and below plugin for WordPress, allows authenticated stored XSS and privilege escalation...

CVE-2019-25143

The GDPR Cookie Compliance plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the gdprcookiecomplianceresetsettings AJAX action in versions up to, and including, 4.0.2. This makes it possible for authenticated attackers to reset all of the settings...

CVE-2019-14950

The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page...

CVE-2025-48260

Missing Authorization vulnerability in Ninja Team GDPR CCPA Compliance Support ninja-gdpr-compliance allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GDPR CCPA Compliance Support: from n/a through = 2.7.3...

WordPress GDPR CCPA Compliance Support plugin <= 2.7.3 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Aiden in WordPress Plugin GDPR CCPA Compliance Support versions = 2.7.3...

CVE-2025-48260

Missing Authorization vulnerability in Ninja Team GDPR CCPA Compliance Support ninja-gdpr-compliance allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GDPR CCPA Compliance Support: from n/a through = 2.7.3...

CVE-2025-48260 WordPress GDPR CCPA Compliance Support plugin <= 2.7.3 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Ninja Team GDPR CCPA Compliance Support ninja-gdpr-compliance allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GDPR CCPA Compliance Support: from n/a through = 2.7.3...

CVE-2025-48260 WordPress GDPR CCPA Compliance Support <= 2.7.3 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Ninja Team GDPR CCPA Compliance Support allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects GDPR CCPA Compliance Support: from n/a through 2.7.3...

CVE-2025-48260

CVE-2025-48260 corresponds to a Missing Authorization (broken access control) vulnerability in the WordPress plugin GDPR CCPA Compliance Support. The weakness affects versions up to 2.7.3 and is described as allowing exploitation of incorrectly configured access control levels. The CVSSv3.1 score...

WordPress GDPR Cookie Consent plugin <= 2.6.0 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Zitec/Teodora Jilaveanu in WordPress Plugin GDPR Cookie Consent versions = 2.6.0...

WordPress The GDPR Framework By Data443 plugin < 2.2.0 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin GDPR Framework By Data443 versions 2.2.0...

PT-2025-21972 · Unknown · Ninjateam Gdpr Ccpa Compliance Support

Name of the Vulnerable Software and Affected Versions: Ninja Team GDPR CCPA Compliance Support versions 2.7.3 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For...

CVE-2024-13621

The GDPR Framework By Data443 WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

Meta sent cease and desist letter over AI training

EU privacy advocacy group NOYB has clapped back at Meta over its plans to start training its AI model on European users' data. In a cease and desist letter to the social networking giant's Irish operation signed by founder Max Schrems, the non-profit demanded that it justify its actions or risk...

CVE-2024-8286

The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting visit logs via CSRF attacks...

CVE-2024-8397

The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not properly sanitize and escape the IP headers when logging them, allowing visitors to conduct Stored Cross-Site Scripting attacks. The payload gets triggered when an admin visits the 'Consent report' page and the malicious...

CVE-2024-8397 GDPR Cookie Consent <= 2.6.0 - Unauthenticated Stored XSS

The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not properly sanitize and escape the IP headers when logging them, allowing visitors to conduct Stored Cross-Site Scripting attacks. The payload gets triggered when an admin visits the 'Consent report' page and the malicious...