WP GDPR Compliance <= 2.0.23 - Cross-Site Request Forgery
medium
The WP GDPR Compliance plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.23. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action granted they can trick a site a...
- CVSS:
- 4.3
- Affected:
- up to 2.0.23
- Fix:
- No patched version reported
- Disclosed:
- Apr 26, 2024
CVE-2024-33682 on NVD →
Cookie Information | Free GDPR Consent Solution <= 2.0.22 - Authenticated (Subscriber+) Arbitrary Options Update
high
The Cookie Information | Free GDPR Consent Solution plugin for WordPress is vulnerable to arbitrary option updates due to a missing capability check on its AJAX request handler in versions up to, and including, 2.0.22. This makes it possible for authenticated attackers, with subscriber-level access or higher, to edit a...
- CVSS:
- 8.8
- Affected:
- up to 2.0.22
- Fixed in:
- 2.0.23
- Disclosed:
- Jan 29, 2024
CVE-2023-6700 on NVD →
Cookie Information | Free GDPR Consent Solution <= 2.0.7 - Reflected Cross-Site Scripting
medium
The Cookie Information | Free GDPR Consent Solution WordPress plugin before 2.0.8 does not escape user data before outputting it back in attributes in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
- CVSS:
- 6.1
- Affected:
- up to 2.0.8
- Fixed in:
- 2.0.8
- Disclosed:
- Feb 21, 2022
CVE-2022-0147 on NVD →
Cookie Information | Free GDPR Consent Solution <= 1.5.5 - Stored Cross-Site Scripting
medium
The Cookie Information | Free GDPR Consent Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘$ipAddress’ parameter in versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...
- CVSS:
- 4.7
- Affected:
- up to 1.5.5
- Fixed in:
- 1.5.6
- Disclosed:
- Mar 1, 2021
WP GDPR Compliance <= 1.4.2 - Arbitrary Options Update and Action Calling
critical
The WP GDPR Compliance plugin for WordPress is vulnerability to arbitrary options updates and action calling in versions up to, and including 1.4.2 due to insufficient capability checking on the wpgdprc_process_action AJAX action. This missing it possible for unauthenticated attackers to trigger the AJAX action and m...
- CVSS:
- 9.8
- Affected:
- up to 1.4.3
- Fixed in:
- 1.4.3
- Disclosed:
- Nov 8, 2018
CVE-2018-19207 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database