CVE-2024-8397

GDPR Cookie Consent <= 2.6.0 - Unauthenticated Stored XSS

Medium · published May 15, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
24.4
In the wild
Unconfirmed
What it is

The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not properly sanitize and escape the IP headers when logging them, allowing visitors to conduct Stored Cross-Site Scripting attacks. The payload gets triggered when an admin visits the 'Consent report' page and the malicious script is executed in the admin context.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00326 · 24.4th percentile
Published
2025-05-15T20:07Z
EPSS history
Timeline
  • 15 MAY 20:07Z
    GDPR Cookie Consent <= 2.6.0 - Unauthenticated Stored XSS
    cvelistv5