CVE-2024-8286

The webtoffee-gdpr-cookie-consent WordPress plugin, in versions prior to 2.6.1 , is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The root cause is a lack of CSRF checks in certain bulk actions, which could allow an attacker to trick a logged-in administrator into performing unwanted ...

CVE-2024-8397

The webtoffee-gdpr-cookie-consent WordPress plugin (versions prior to 2.6.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitize and escape IP headers during the logging process. An attacker can inject a malicious payload that executes in the a...