WordPress plugin
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical2
- High6
- Medium20
- Low0
All WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode vulnerabilities
- High7.2Unauthenticated Stored Cross-Site Scripting
≤4.4.6Update to 4.4.7
- High7.2Unauthenticated Stored Cross-Site Scripting
≤4.4.3Update to 4.4.4
- Medium4.3Cross-Site Request Forgery
≤4.4.3Update to 4.4.4
- High7.2Unauthenticated Stored Cross-Site Scripting via 'wpl_user_preference' Parameter
≤4.4.1Update to 4.4.2
- Medium4.34.4.1 - Missing Authorization to Information Exposure
4.0.2 – 4.4.1Update to 4.4.2
- Medium5.3Missing Authorization
≤4.4.1Update to 4.4.2
- Medium4.3Missing Authorization
≤4.4.1Update to 4.4.2
- Medium4.3Missing Authorization
≤4.4.1Update to 4.4.2
- Medium4.9Authenticated (Administrator+) SQL Injection
<4.4.2Update to 4.4.2
- Critical9.8Unauthenticated Arbitrary File Upload via 'upload-logo' REST Endpoint
≤4.4.1Update to 4.4.2
- Critical9.8Unauthenticated Arbitrary File Upload
≤4.4.1Update to 4.4.2
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤4.3.9Update to 4.4.0
- High7.2Authenticated (Subscriber+) Stored Cross-Site Scripting via 'regionArray' Parameter
≤4.3.5Update to 4.4.0
- Medium4.3Cross-Site Request Forgery via Bulk Action to Delete/Resolve Entries
≤4.3.7Update to 4.3.8
- Medium4.9Authenticated (Administrator+) SQL Injection via 'scan_id' Parameter
≤4.3.6Update to 4.3.7
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Scan Schedule Modification via gcc_save_schedule_scan AJAX Action
≤4.3.6Update to 4.3.7
- Medium4.9Authenticated (Administrator+) SQL Injection via 's' Parameter
≤4.3.5Update to 4.3.6
- High7.5Missing Authorization to Sensitive Information Exposure
≤4.1.2Update to 4.1.3
- Medium5.3Missing Authorization
≤4.0.3Update to 4.0.4
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Post Deletion
≤4.0.7Update to 4.0.8
- Medium5.3Missing Authorization
≤4.0.7Update to 4.0.8
- Medium4.3Missing Authorization
≤4.0.3Update to 4.0.4
- Medium4.3Cross-Site Request Forgery
≤3.8.0Update to 3.8.1
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Whitelist Script
≤3.6.5Update to 3.6.6
- High7.2Unauthenticated Stored Cross-Site Scripting via Client-IP header
≤3.2.0Update to 3.3.0
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Post Deletion
≤3.0.2Update to 3.1.0
- Medium6.4Authenticated(Administrator+) CSV Injection
≤2.2.5Update to 2.2.6
- Medium6.3Missing Authorization Checks
all versionsNo patch available
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode: common questions
Does WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode have known vulnerabilities?
Yes. VulnCrest Radar lists 28 known vulnerabilities in WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode: 2 critical, 6 high, 20 medium. At least one is not fixed in the latest version.
How do I check which version of WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode vulnerability?
CVE-2026-42636, published Oct 5, 2026: WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode <= 4.4.6 - Unauthenticated Stored Cross-Site Scripting. Severity: High (CVSS 7.2).
Is any WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode vulnerability listed in CISA KEV?
No. None of the known WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode vulnerabilities is currently listed in the CISA KEV catalog.