Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

172 results · page 2 of 4

Jan 24, 2026Cookie consent for developers: Stored Cross-Site ScriptingCVE-2026-1084 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Cookie consent for developers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple settings fields in all versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Cookie consent for developers
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update Cookie consent for developers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 23, 2026Simple GDPR Cookie Compliance: Missing AuthorizationCVE-2026-24604 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themebeez Simple GDPR Cookie Compliance simple-gdpr-cookie-compliance allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple GDPR Cookie Compliance: from n/a through <= 2.0.0.
Product
Simple GDPR Cookie Compliance
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Simple GDPR Cookie Compliance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Civic Cookie Control: Missing AuthorizationCVE-2026-22348 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Tasos Fel Civic Cookie Control civic-cookie-control-8 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Civic Cookie Control: from n/a through <= 1.53.
Product
Civic Cookie Control
Affected
up to 1.53
What to do
Affects up to 1.53. Update Civic Cookie Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Cookies and Content Security Policy: Insertion of Sensitive Information Into Sent DataCVE-2025-63019 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in Johan Jonk Stenström Cookies and Content Security Policy cookies-and-content-security-policy allows Retrieve Embedded Sensitive Data.This issue affects Cookies and Content Security Policy: from n/a through <= 2.34.
Product
Cookies and Content Security Policy
Affected
up to 2.34
What to do
Affects up to 2.34. Update Cookies and Content Security Policy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 30, 2025WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: Missing AuthorizationCVE-2025-66080 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through <= 4.0.3.
Product
WP Cookie Notice for GDPR, CCPA & ePrivacy Consent
Affected
up to 4.0.3
What to do
Affects up to 4.0.3. Update WP Cookie Notice for GDPR, CCPA & ePrivacy Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 29, 2025CookieHint WP: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68870 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in reDim GmbH CookieHint WP cookiehint-wp allows PHP Local File Inclusion.This issue affects CookieHint WP: from n/a through <= 1.0.0.
Product
CookieHint WP
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update CookieHint WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 17, 2025The Cookie Banner, Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) : WP Cookie Consent plugin for WordPress is vulnerablCVE-2025-14061 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Cookie Banner, Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) : WP Cookie Consent plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the gdpr_delete_policy_data function in all versions up to, and including, 4.0.7. This makes it possible for unauthenticated attackers to permanently delete arbitrary posts, pages, attachments, and other post types by ID.
Affected
up to 4.0.7
What to do
Affects up to 4.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 16, 2025WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: Missing AuthorizationCVE-2025-66133 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through <= 4.0.7.
Product
WP Cookie Notice for GDPR, CCPA & ePrivacy Consent
Affected
up to 4.0.7
What to do
Affects up to 4.0.7. Update WP Cookie Notice for GDPR, CCPA & ePrivacy Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Cookie Notice & Compliance for GDPR / CCPA: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67554 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Humanityco Cookie Notice & Compliance for GDPR / CCPA cookie-notice allows Stored XSS.This issue affects Cookie Notice & Compliance for GDPR / CCPA: from n/a through <= 2.5.8.
Product
Cookie Notice & Compliance for GDPR / CCPA
Affected
up to 2.5.8
What to do
Affects up to 2.5.8. Update Cookie Notice & Compliance for GDPR / CCPA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 22, 2025Cookie Notice & Compliance for GDPR / CCPA: Stored Cross-Site ScriptingCVE-2025-11186 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Cookie Notice & Compliance for GDPR / CCPA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cookies_accepted shortcode in all versions up to, and including, 2.5.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Cookie Notice & Compliance for GDPR / CCPA
Affected
up to 2.5.8
What to do
Affects up to 2.5.8. Update Cookie Notice & Compliance for GDPR / CCPA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 21, 2025WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: Missing AuthorizationCVE-2025-66075 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through <= 4.0.3.
Product
WP Cookie Notice for GDPR, CCPA & ePrivacy Consent
Affected
up to 4.0.3
What to do
Affects up to 4.0.3. Update WP Cookie Notice for GDPR, CCPA & ePrivacy Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025WP GDPR Cookie Consent: Cross-Site Request Forgery (CSRF)CVE-2025-53316 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Shahjahan Jewel WP GDPR Cookie Consent wp-gdpr-cookie-consent allows Stored XSS.This issue affects WP GDPR Cookie Consent: from n/a through <= 1.0.0.
Product
WP GDPR Cookie Consent
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update WP GDPR Cookie Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025Cookie Notice & Consent: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49390 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in christophrado Cookie Notice & Consent cookie-notice-consent allows Stored XSS.This issue affects Cookie Notice & Consent: from n/a through <= 1.6.4.
Product
Cookie Notice & Consent
Affected
up to 1.6.4
What to do
Affects up to 1.6.4. Update Cookie Notice & Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 4, 2025Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More: Stored Cross-Site ScriptingCVE-2025-12045 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the category and tag 'name' parameters in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 24, 2025Real Cookie Banner: GDPR & ePrivacy Cookie Consent: Server-Side Request ForgeryCVE-2025-12136 · WordPress plugins & themes · reported by WordfenceMedium 6.8
The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.2.4. This is due to insufficient validation on the user-supplied URL in the '/scanner/scan-without-login' REST API endpoint. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services via the `url` parameter.
Product
Real Cookie Banner: GDPR & ePrivacy Cookie Consent
Affected
up to 5.2.4
What to do
Affects up to 5.2.4. Update Real Cookie Banner: GDPR & ePrivacy Cookie Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record infosecstuff.com owasp.org
Oct 24, 2025Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More: Does not limit URLsCVE-2025-10874 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.2 does not limit URLs which may be used for the stock photo import feature, allowing the user to specify arbitrary URLs. This leads to a server-side request forgery as the user may force the server to access any URL of their choosing.
Product
Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More
Fixed in
3.0.2
What to do
Update Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More to 3.0.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 8, 2025Cookie Notice & Consent: Stored Cross-Site ScriptingCVE-2025-10496 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Cookie Notice & Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the uuid parameter in all versions up to, and including, 1.6.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Cookie Notice & Consent
Affected
up to 1.6.5
What to do
Affects up to 1.6.5. Update Cookie Notice & Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 22, 2025Termageddon: Cookie Consent & Privacy Compliance: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58026 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in termageddon Termageddon: Cookie Consent & Privacy Compliance termageddon-usercentrics allows Stored XSS.This issue affects Termageddon: Cookie Consent & Privacy Compliance: from n/a through <= 1.8.1.
Product
Termageddon: Cookie Consent & Privacy Compliance
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update Termageddon: Cookie Consent & Privacy Compliance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 5, 2025SimaCookie: Cross-Site Request Forgery (CSRF)CVE-2025-58869 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in Simasicher SimaCookie simasicher-dsgvo-cookie allows Stored XSS.This issue affects SimaCookie: from n/a through <= 1.3.2.
Product
SimaCookie
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update SimaCookie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 5, 2025SimaCookie: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58868 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simasicher SimaCookie simasicher-dsgvo-cookie allows Stored XSS.This issue affects SimaCookie: from n/a through <= 1.3.2.
Product
SimaCookie
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update SimaCookie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2025Cookie Notice & Consent Banner for GDPR & CCPA Compliance: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58607 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GDPR Info Cookie Notice & Consent Banner for GDPR & CCPA Compliance cookie-notice-and-consent-banner allows Stored XSS.This issue affects Cookie Notice & Consent Banner for GDPR & CCPA Compliance: from n/a through <= 1.7.11.
Product
Cookie Notice & Consent Banner for GDPR & CCPA Compliance
Affected
up to 1.7.11
What to do
Affects up to 1.7.11. Update Cookie Notice & Consent Banner for GDPR & CCPA Compliance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Cookie Warning: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49428 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dourou Cookie Warning allows Stored XSS. This issue affects Cookie Warning: from n/a through 1.3.
Product
Cookie Warning
Affected
up to 1.3
What to do
Affects up to 1.3. Update Cookie Warning to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 19, 2025Multiple FunnelKit plugins are vulnerable to Sensitive Information Exposure via the wf_get_cookie shortcode.CVE-2025-7654 · WordPress plugins & themes · reported by WordfenceHigh 8.8
Multiple FunnelKit plugins are vulnerable to Sensitive Information Exposure via the wf_get_cookie shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including authentication cookies of other site users, which may make privilege escalation possible. Please note both FunnelKit – Funnel Builder for WooCommerce Checkout AND FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce are affected by this.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 14, 2025WP Modal Popup with Cookie Integration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54683 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Astoundify WP Modal Popup with Cookie Integration wp-modal-popup-with-cookie-integration allows Reflected XSS.This issue affects WP Modal Popup with Cookie Integration: from n/a through <= 2.4.
Product
WP Modal Popup with Cookie Integration
Affected
up to 2.4
What to do
Affects up to 2.4. Update WP Modal Popup with Cookie Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 4, 2025Beautiful Cookie Consent Banner: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49866 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nikel Beautiful Cookie Consent Banner beautiful-and-responsive-cookie-consent allows Reflected XSS.This issue affects Beautiful Cookie Consent Banner: from n/a through <= 4.6.1.
Product
Beautiful Cookie Consent Banner
Affected
up to 4.6.1
What to do
Affects up to 4.6.1. Update Beautiful Cookie Consent Banner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025Cookiebot: Cross-Site Request Forgery (CSRF)CVE-2025-53197 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in cookiebot Cookiebot cookiebot allows Cross Site Request Forgery.This issue affects Cookiebot: from n/a through <= 4.5.8.
Product
Cookiebot
Affected
up to 4.5.8
What to do
Affects up to 4.5.8. Update Cookiebot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025Cookie-Script.com: Missing AuthorizationCVE-2025-49993 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in csarturas Cookie-Script.com cookie-script-com allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cookie-Script.com: from n/a through <= 1.2.1.
Product
Cookie-Script.com
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Cookie-Script.com to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 6, 2025WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: Cross-Site Request Forgery (CSRF)CVE-2025-49285 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Cross Site Request Forgery.This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through <= 3.8.0.
Product
WP Cookie Notice for GDPR, CCPA & ePrivacy Consent
Affected
up to 3.8.0
What to do
Affects up to 3.8.0. Update WP Cookie Notice for GDPR, CCPA & ePrivacy Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 2, 2025Real Cookie Banner: GDPR & ePrivacy Cookie Consent WordPress plugin before 5.1.6, real-cookie-banner-pro: Does not sanitise and escape some of its settingsCVE-2025-1485 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Real Cookie Banner: GDPR & ePrivacy Cookie Consent WordPress plugin before 5.1.6, real-cookie-banner-pro WordPress plugin before 5.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Real Cookie Banner: GDPR & ePrivacy Cookie Consent WordPress plugin before 5.1.6, real-cookie-banner-pro
Fixed in
5.1.6
What to do
Update Real Cookie Banner: GDPR & ePrivacy Cookie Consent WordPress plugin before 5.1.6, real-cookie-banner-pro to 5.1.6 or newer.
Full record and what to do →NVD record wpscan.com
May 19, 2025cookieBAR: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-43834 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tox82 cookieBAR cookiebar allows Stored XSS.This issue affects cookieBAR: from n/a through <= 1.7.0.
Product
cookieBAR
Affected
up to 1.7.0
What to do
Affects up to 1.7.0. Update cookieBAR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 15, 2025webtoffee-gdpr-cookie-consent: Does not properly sanitize and escape the IP headersCVE-2024-8397 · WordPress plugins & themes · reported by WPScanMedium 5.4
The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not properly sanitize and escape the IP headers when logging them, allowing visitors to conduct Stored Cross-Site Scripting attacks. The payload gets triggered when an admin visits the 'Consent report' page and the malicious script is executed in the admin context.
Product
webtoffee-gdpr-cookie-consent
Fixed in
2.6.1
What to do
Update webtoffee-gdpr-cookie-consent to 2.6.1 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025webtoffee-gdpr-cookie-consent: Does not have CSRF checks in some bulk actionsCVE-2024-8286 · WordPress plugins & themes · reported by WPScanMedium 6.5
The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting visit logs via CSRF attacks
Product
webtoffee-gdpr-cookie-consent
Fixed in
2.6.1
What to do
Update webtoffee-gdpr-cookie-consent to 2.6.1 or newer.
Full record and what to do →NVD record wpscan.com
May 9, 2025EUCookieLaw: Arbitrary File ReadCVE-2025-3897 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The EUCookieLaw plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.7.2 via the 'file_get_contents' function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The vulnerability can only be exploited if a caching plugin such as W3 Total Cache is installed and activated.
Product
EUCookieLaw
Affected
up to 2.7.2
What to do
Affects up to 2.7.2. Update EUCookieLaw to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 7, 2025CookieCode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47668 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cookiecode CookieCode cookiecode allows Stored XSS.This issue affects CookieCode: from n/a through <= 2.4.4.
Product
CookieCode
Affected
up to 2.4.4
What to do
Affects up to 2.4.4. Update CookieCode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 24, 2025WP Cookie Consent: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46525 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in msmitley WP Cookie Consent wp-cookie-consent allows Stored XSS.This issue affects WP Cookie Consent: from n/a through <= 1.0.
Product
WP Cookie Consent
Affected
up to 1.0
What to do
Affects up to 1.0. Update WP Cookie Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025illow – Cookies Consent: Cross-Site Request Forgery (CSRF)CVE-2025-39426 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in illow illow – Cookies Consent lgpd-compliant-cookie-banner allows Cross Site Request Forgery.This issue affects illow – Cookies Consent: from n/a through <= 0.2.0.
Product
illow – Cookies Consent
Affected
up to 0.2.0
What to do
Affects up to 0.2.0. Update illow – Cookies Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025WP Modal Popup with Cookie Integration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31772 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Astoundify WP Modal Popup with Cookie Integration wp-modal-popup-with-cookie-integration allows Stored XSS.This issue affects WP Modal Popup with Cookie Integration: from n/a through <= 2.4.
Product
WP Modal Popup with Cookie Integration
Affected
up to 2.4
What to do
Affects up to 2.4. Update WP Modal Popup with Cookie Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025GDPR Cookie Notice: Missing AuthorizationCVE-2025-31765 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themeqx GDPR Cookie Notice gdpr-cookie-notice allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GDPR Cookie Notice: from n/a through <= 1.2.0.
Product
GDPR Cookie Notice
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update GDPR Cookie Notice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025CookieHint WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31608 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reDim GmbH CookieHint WP cookiehint-wp allows Stored XSS.This issue affects CookieHint WP: from n/a through <= 1.0.0.
Product
CookieHint WP
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update CookieHint WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Flexible Cookies: Cross-Site Request Forgery (CSRF)CVE-2025-30805 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in wpdesk Flexible Cookies flexible-cookies allows Cross Site Request Forgery.This issue affects Flexible Cookies: from n/a through <= 1.1.8.
Product
Flexible Cookies
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update Flexible Cookies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025Cookies Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26546 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelpro Cookies Pro cookies-pro allows Reflected XSS.This issue affects Cookies Pro: from n/a through <= 1.0.
Product
Cookies Pro
Affected
up to 1.0
What to do
Affects up to 1.0. Update Cookies Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 16, 2025GDPR Cookie Compliance: Does not sanitise and escape some of its settingsCVE-2025-1624 · WordPress plugins & themes · reported by WPScanLow 3.5
The GDPR Cookie Compliance WordPress plugin before 4.15.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
GDPR Cookie Compliance
Fixed in
4.15.9
What to do
Update GDPR Cookie Compliance to 4.15.9 or newer.
Full record and what to do →NVD record wpscan.com
Mar 16, 2025GDPR Cookie Compliance: Does not sanitise and escape some of its settingsCVE-2025-1623 · WordPress plugins & themes · reported by WPScanLow 3.5
The GDPR Cookie Compliance WordPress plugin before 4.15.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
GDPR Cookie Compliance
Fixed in
4.15.9
What to do
Update GDPR Cookie Compliance to 4.15.9 or newer.
Full record and what to do →NVD record wpscan.com
Mar 16, 2025GDPR Cookie Compliance: Does not sanitise and escape some of its settingsCVE-2025-1622 · WordPress plugins & themes · reported by WPScanLow 3.5
The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
GDPR Cookie Compliance
Fixed in
4.15.7
What to do
Update GDPR Cookie Compliance to 4.15.7 or newer.
Full record and what to do →NVD record wpscan.com
Mar 16, 2025GDPR Cookie Compliance: Does not sanitise and escape some of its settingsCVE-2025-1621 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
GDPR Cookie Compliance
Fixed in
4.15.7
What to do
Update GDPR Cookie Compliance to 4.15.7 or newer.
Full record and what to do →NVD record wpscan.com
Mar 16, 2025GDPR Cookie Compliance: Does not sanitise and escape some of its settingsCVE-2025-1620 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
GDPR Cookie Compliance
Fixed in
4.15.7
What to do
Update GDPR Cookie Compliance to 4.15.7 or newer.
Full record and what to do →NVD record wpscan.com
Mar 16, 2025GDPR Cookie Compliance: Does not sanitise and escape some of its settingsCVE-2025-1619 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
GDPR Cookie Compliance
Fixed in
4.15.7
What to do
Update GDPR Cookie Compliance to 4.15.7 or newer.
Full record and what to do →NVD record wpscan.com
Mar 12, 2025GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice – CCPA, DSGVO, RGPD: Stored Cross-Site ScriptingCVE-2025-2205 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice – CCPA, DSGVO, RGPD plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.15.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice – CCPA, DSGVO, RGPD
Affected
up to 4.15.6
What to do
Affects up to 4.15.6. Update GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice – CCPA, DSGVO, RGPD to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record research.cleantalk.org wpscan.com
Mar 6, 2025Cookie banner plugin for WordPress – Cookiebot CMP by Usercentrics: Unauthorized modification of dataCVE-2025-1666 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Cookie banner plugin for WordPress – Cookiebot CMP by Usercentrics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the send_uninstall_survey() function in all versions up to, and including, 4.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to submit the uninstall survey on behalf of a website.
Product
Cookie banner plugin for WordPress – Cookiebot CMP by Usercentrics
Affected
up to 4.4.1
What to do
Affects up to 4.4.1. Update Cookie banner plugin for WordPress – Cookiebot CMP by Usercentrics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 3, 2025Implied Cookie Consent: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25113 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Senktec Implied Cookie Consent implied-cookie-consent allows Reflected XSS.This issue affects Implied Cookie Consent: from n/a through <= 1.3.
Product
Implied Cookie Consent
Affected
up to 1.3
What to do
Affects up to 1.3. Update Implied Cookie Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.