4.3
Medium
CVE-2026-12955 The GDPR Cookie Consent plugin for WordPress is vulnerable to unauthorized modification of data due to a missing…
Description
The GDPR Cookie Consent plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the gdpr_cookie_consent_ajax_save_schedule_scan() function (the wp_ajax_gcc_save_schedule_scan AJAX action) in versions up to, and including, 4.3.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the plugin's cookie scan schedule configuration stored in the gdpr_scan_schedule_data option, which is an administrative function intended to be limited to users with the manage_options capability.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Cookie Banner for GDPR / CCPA – WPLP Cookie Consent 4.3 | earliest → 4.3.6 | No fix stated |
Other CVEs of Cookie Banner for GDPR / CCPA – WPLP Cookie Consent
The 9 CVEs of Cookie Banner for GDPR / CCPA – WPLP Cookie Consent →
CVE-2026-14475
The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to generic SQL Injection…
4.9
Medium
CVE-2026-12920
The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to generic SQL Injection…
4.9
Medium
CVE-2025-11754
The GDPR Cookie Consent plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability…
7.5
High
CVE-2025-14061
The Cookie Banner, Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) : WP Cookie…
5.3
Medium