plugin

Wp Gdpr Compliance Vulnerabilities

5 known security issues reported for the Wp Gdpr Compliance WordPress plugin. Most recent disclosed Apr 26, 2024.

1 critical 1 high 3 medium

Running Wp Gdpr Compliance on your site? Check whether your installed version is affected.

Scan your site free

WP GDPR Compliance <= 2.0.23 - Cross-Site Request Forgery

medium

The WP GDPR Compliance plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.23. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action granted they can trick a site a...

CVSS:
4.3
Affected:
up to 2.0.23
Fix:
No patched version reported
Disclosed:
Apr 26, 2024

CVE-2024-33682 on NVD →

Cookie Information | Free GDPR Consent Solution <= 2.0.22 - Authenticated (Subscriber+) Arbitrary Options Update

high

The Cookie Information | Free GDPR Consent Solution plugin for WordPress is vulnerable to arbitrary option updates due to a missing capability check on its AJAX request handler in versions up to, and including, 2.0.22. This makes it possible for authenticated attackers, with subscriber-level access or higher, to edit a...

CVSS:
8.8
Affected:
up to 2.0.22
Fixed in:
2.0.23
Disclosed:
Jan 29, 2024

CVE-2023-6700 on NVD →

Cookie Information | Free GDPR Consent Solution <= 2.0.7 - Reflected Cross-Site Scripting

medium

The Cookie Information | Free GDPR Consent Solution WordPress plugin before 2.0.8 does not escape user data before outputting it back in attributes in the admin dashboard, leading to a Reflected Cross-Site Scripting issue

CVSS:
6.1
Affected:
up to 2.0.8
Fixed in:
2.0.8
Disclosed:
Feb 21, 2022

CVE-2022-0147 on NVD →

Cookie Information | Free GDPR Consent Solution <= 1.5.5 - Stored Cross-Site Scripting

medium

The Cookie Information | Free GDPR Consent Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘$ipAddress’ parameter in versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...

CVSS:
4.7
Affected:
up to 1.5.5
Fixed in:
1.5.6
Disclosed:
Mar 1, 2021

WP GDPR Compliance <= 1.4.2 - Arbitrary Options Update and Action Calling

critical

The WP GDPR Compliance plugin for WordPress is vulnerability to arbitrary options updates and action calling in versions up to, and including 1.4.2 due to insufficient capability checking on the wpgdprc_process_action AJAX action. This missing it possible for unauthenticated attackers to trigger the AJAX action and m...

CVSS:
9.8
Affected:
up to 1.4.3
Fixed in:
1.4.3
Disclosed:
Nov 8, 2018

CVE-2018-19207 on NVD →

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database