Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-18
WPLP Cookie Consent - Security Vulnerability (CVE-2026-85130)
The WPLP Cookie Consent WordPress plugin before 4.4.4 does not escape a value submitted through a public endpoint for the JavaScript context it is later output in on an administrative screen, allowing unauthenticated users to run arbitrary JavaScript in the session of an administrator who interacts with the logged entry. Only multisite installations are affected.
PLUGIN
WPLP Cookie Consent
CVE-2026-85130
Risk Score
Threat Entry
Updated 2026-09-17
WPLP Cookie Consent - Security Vulnerability (CVE-2026-85131)
The WPLP Cookie Consent WordPress plugin before 4.4.4 does not perform CSRF or capability checks when processing bulk actions on its administration screens, and does not restrict the targeted items to its own records, allowing attackers to make a logged in admin permanently delete arbitrary posts and pages via a crafted request.
PLUGIN
WPLP Cookie Consent
CVE-2026-85131
Risk Score
Threat Entry
Updated 2026-09-09
WPLP Cookie Consent - Cross-Site Request Forgery (CSRF) (CVE-2026-85133)
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on several of its settings AJAX actions, allowing any authenticated user, such as a subscriber, to read and destroy scan data belonging to the administrator and to overwrite the WPLP Cookie Consent WordPress plugin before 4.4.2's stored configuration.
PLUGIN
WPLP Cookie Consent
CVE-2026-85133
Risk Score
Threat Entry
Updated 2026-09-09
WPLP Cookie Consent - Cross-Site Request Forgery (CSRF) (CVE-2026-85132)
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on one of its cookie scanner AJAX actions, allowing any authenticated user, such as a subscriber, to read back the automated scan schedule the administrator configured.
PLUGIN
WPLP Cookie Consent
CVE-2026-85132
Risk Score
Threat Entry
Updated 2026-09-09
WPLP Cookie Consent - Cross-Site Request Forgery (CSRF) (CVE-2026-82184)
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have any authorisation or CSRF checks when storing visitor consent state, and the code that does so runs on every front-end page load, allowing unauthenticated attackers to overwrite a site-wide option with arbitrary data.
PLUGIN
WPLP Cookie Consent
CVE-2026-82184
Risk Score
Threat Entry
Updated 2026-09-09
WPLP Cookie Consent - Cross-Site Request Forgery (CSRF) (CVE-2026-82185)
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have capability or nonce checks on some of its A/B testing actions, allowing any authenticated user, such as a subscriber, to overwrite the cookie banner configuration shown to every visitor and to irreversibly reset the stored A/B test results.
PLUGIN
WPLP Cookie Consent
CVE-2026-82185
Risk Score
Threat Entry
Updated 2026-09-08
WPLP Cookie Consent - SQL Injection (CVE-2026-82186)
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks.
PLUGIN
WPLP Cookie Consent
CVE-2026-82186
Risk Score
Threat Entry
Updated 2026-09-01
WPLP Cookie Consent - Remote Code Execution (CVE-2026-75865)
The WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the saas_upload_logo() function combined with an authorization bypass on the WPLP connector REST endpoints in all versions up to, and including, 4.4.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
PLUGIN
WPLP Cookie Consent
CVE-2026-75865
Risk Score