Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: webtoffee-gdpr-cookie-consent 2.6.1 Clear all filters
TI-2024-07785 CVE-2024-8397 · GHSA-j4qf-29vf-7xcj

GDPR Cookie Consent <= 2.6.0 - Unauthenticated Stored XSS

Priority MEDIUM 58

The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not properly sanitize and escape the IP headers when logging them, allowing visitors to conduct Stored Cross-Site Scripting attacks.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00326 Published 2025-05-15 Fixed in 2.6.1 CWE-79
TI-2024-07682 CVE-2024-8286 · GHSA-6925-xwwp-qwh5

GDPR Cookie Consent <= 2.6.0 - Bulk Delete via CSRF

Priority MEDIUM 62

The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting visit logs v…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00213 Published 2025-05-15 Fixed in 2.6.1 CWE-352