Stored Cross-Site Scripting Vulnerability in WP Cookie Consent Plugin
CVE-2024-4869
7.2HIGH
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 26 June 2024
What is CVE-2024-4869?
The WP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting, primarily through the manipulation of the 'Client-IP' header. This vulnerability exists in all versions up to and including 3.2.0 due to inadequate input sanitization and insufficient output escaping. Consequently, unauthenticated attackers can exploit this weakness to inject arbitrary web scripts into pages. These scripts can execute whenever a user accesses the compromised page, posing a significant threat to the security and integrity of the affected WordPress installations.
Affected Version(s)
Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) * <= 3.2.0