Cross-site Scripting Vulnerability in WP Cookie Consent by WordPress
CVE-2025-46525

5.9MEDIUM

Key Information:

Vendor

WordPress
Status
WP Cookie Consent
Vendor
CVE Published:
24 April 2025

What is CVE-2025-46525?

A stored Cross-site Scripting (XSS) vulnerability exists in the WP Cookie Consent plugin, allowing malicious users to inject harmful scripts into web pages. This issue impacts users of WP Cookie Consent from its initial release up to version 1.0. When exploited, the vulnerability can lead to unauthorized data access, session hijacking, or the distribution of malware, posing significant risks to website integrity and user safety.

Affected Version(s)

WP Cookie Consent <= 1.0

References

https://patchstack.com/database/wordpress/plugin/wp-cooki...
vdb-entry

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nabil Irawan (Patchstack Alliance)
.