Tarteaucitronjs Vulnerabilities

The tarteaucitron.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'embed' shortcode in all versions up to, and including, 1.9.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contribut...

CVSS:

6.4

Affected:

up to 1.9.4

Fixed in:

1.9.5

Disclosed:

May 28, 2025

CVE-2025-4955 on NVD →

Multiple Stored Authenticated Cross-Site Scripting (XSS) vulnerabilities were discovered in tarteaucitron.js – Cookies legislation & GDPR WordPress plugin (versions <= 1.6).

CVSS:

3.4

Affected:

up to 1.6

Fixed in:

1.6.1

Disclosed:

Dec 17, 2021

CVE-2021-36889 on NVD →

Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) discovered in tarteaucitron.js – Cookies legislation & GDPR WordPress plugin (versions <= 1.5.4), vulnerable parameters "tarteaucitronEmail" and "tarteaucitronPass".

CVSS:

8.8

Affected:

up to 1.5.4

Fixed in:

1.6

Disclosed:

Dec 9, 2021

CVE-2021-36887 on NVD →