5.4
Medium
CVE-2026-85133 The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on several of its…
Description
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on several of its settings AJAX actions, allowing any authenticated user, such as a subscriber, to read and destroy scan data belonging to the administrator and to overwrite the WPLP Cookie Consent WordPress plugin before 4.4.2's stored configuration.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WPLP Cookie Consent 4.4 | earliest → < 4.4.2 | 4.4.2 |
Other CVEs of WPLP Cookie Consent
The 7 CVEs of WPLP Cookie Consent →
CVE-2026-85130
The WPLP Cookie Consent WordPress plugin before 4.4.4 does not escape a value submitted through a public endpoint for…
8.8
High
CVE-2026-85131
The WPLP Cookie Consent WordPress plugin before 4.4.4 does not perform CSRF or capability checks when processing bulk…
6.5
Medium
CVE-2026-85132
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on one of its…
4.3
Medium
CVE-2026-82185
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have capability or nonce checks on some of its A/B…
4.3
Medium