Beautiful And Responsive Cookie Consent Vulnerabilities

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nikel Beautiful Cookie Consent Banner allows Reflected XSS. This issue affects Beautiful Cookie Consent Banner: from n/a through 4.6.1.

Affected:

up to 4.6.2

Fixed in:

4.6.2

Disclosed:

Jul 4, 2025

CVE-2025-49866 on NVD →

The Beautiful Cookie Consent Banner plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 4.6.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if t...

CVSS:

6.1

Affected:

up to 4.6.1

Fixed in:

4.6.2

Disclosed:

Jul 1, 2025

CVE-2025-49866 on NVD →

[en] The Beautiful Cookie Consent Banner for WordPress is vulnerable to Stored Cross-Site Scripting via the 'nsc_bar_content_href' parameter in versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web s...

Affected:

up to 2.10.2

Fixed in:

2.10.2

Disclosed:

Jun 24, 2023

CVE-2023-3388 on NVD →

Update the WordPress Beautiful Cookie Consent Banner plugin to the latest available version (at least 2.10.1). Wordfence discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Beautiful Cookie Consent Banner Plugin. This could allow a malicious actor to inject malicious scripts, such as redi...

Affected:

up to 2.10.1

Fixed in:

2.10.1

Disclosed:

Feb 1, 2023

Update the WordPress Beautiful Cookie Consent Banner plugin to the latest available version (at least 2.10.1). Wordfence discovered and reported this Broken Access Control vulnerability in WordPress Beautiful Cookie Consent Banner Plugin. This vulnerability has been fixed in version 2.10.1.

Affected:

up to 2.10.1

Fixed in:

2.10.1

Disclosed:

Feb 1, 2023

The Beautiful Cookie Consent Banner plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the nsc_bar_save_submitted_form_fields() function called via and admin_init hook in versions up to, and including, 2.10.0. This makes it possible for unauthenticated attackers to modify th...

CVSS:

7.3

Affected:

up to 2.10.0

Fixed in:

2.10.1

Disclosed:

Jan 31, 2023

The Beautiful Cookie Consent Banner for WordPress is vulnerable to Stored Cross-Site Scripting via the 'nsc_bar_content_href' parameter in versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...

CVSS:

7.2

Affected:

up to 2.10.1

Fixed in:

2.10.2

Disclosed:

Jan 31, 2023

CVE-2023-3388 on NVD →

The Beautiful Cookie Consent Banner plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the nsc_bar_save_submitted_form_fields() function called via and admin_init hook in versions up to, and including, 2.10.0. This makes it possible for unauthenticated attackers to modify th...

Affected:

up to 2.10.1

Fixed in:

2.10.1

Disclosed:

Jan 31, 2023

The Beautiful Cookie Consent Banner for WordPress is vulnerable to Stored Cross-Site Scripting via the 'nsc_bar_content_href' parameter in versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...

Affected:

up to 2.10.1

Fixed in:

2.10.1

Disclosed:

Jan 31, 2023

[en] The Beautiful Cookie Consent Banner WordPress plugin before 2.9.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Affected:

up to 2.9.1

Fixed in:

2.9.1

Disclosed:

Nov 28, 2022

CVE-2022-3823 on NVD →

The Beautiful Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 2.9.0 due to insufficient input sanitization and output escaping. This makes it possible for administrator-level attackers to inject arbitrary web scripts in pa...

CVSS:

5.5

Affected:

up to 2.9.0

Fixed in:

2.9.1

Disclosed:

Nov 3, 2022

CVE-2022-3823 on NVD →

The plugin does not have authorisation and CSRF check when updating its settings, and does not escape some of them when outputting them, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks. An initial fix was released in version 2.10.1, and completed in 2.10.2. Note: The issue...

Affected:

up to 2.10.2

Fixed in:

2.10.2