8.8
Élevée
CVE-2026-85130 The WPLP Cookie Consent WordPress plugin before 4.4.4 does not escape a value submitted through a public endpoint for…
Description
The WPLP Cookie Consent WordPress plugin before 4.4.4 does not escape a value submitted through a public endpoint for the JavaScript context it is later output in on an administrative screen, allowing unauthenticated users to run arbitrary JavaScript in the session of an administrator who interacts with the logged entry. Only multisite installations are affected.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| WPLP Cookie Consent 4.4 | premières → < 4.4.4 | 4.4.4 |
Autres CVE de WPLP Cookie Consent
Les 7 CVE de WPLP Cookie Consent →
CVE-2026-85131
The WPLP Cookie Consent WordPress plugin before 4.4.4 does not perform CSRF or capability checks when processing bulk…
6.5
Moyenne
CVE-2026-85133
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on several of its…
5.4
Moyenne
CVE-2026-85132
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on one of its…
4.3
Moyenne
CVE-2026-82185
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have capability or nonce checks on some of its A/B…
4.3
Moyenne