WordPress plugin
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical2
- High6
- Medium20
- Low0
All WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤4.4.6Update to 4.4.7 | CVE-2026-42636 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤4.4.3Update to 4.4.4 | CVE-2026-85130 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting via 'wpl_user_preference' Parameter ≤4.4.1Update to 4.4.2 | CVE-2026-14989 | |
| Critical9.8 | Unauthenticated Arbitrary File Upload via 'upload-logo' REST Endpoint ≤4.4.1Update to 4.4.2 | CVE-2026-75865 | |
| Critical9.8 | Unauthenticated Arbitrary File Upload ≤4.4.1Update to 4.4.2 | CVE-2026-82970 | |
| High7.2 | Authenticated (Subscriber+) Stored Cross-Site Scripting via 'regionArray' Parameter ≤4.3.5Update to 4.4.0 | CVE-2026-13360 | |
| High7.5 | Missing Authorization to Sensitive Information Exposure ≤4.1.2Update to 4.1.3 | CVE-2025-11754 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting via Client-IP header ≤3.2.0Update to 3.3.0 | CVE-2024-4869 |
- High7.2Unauthenticated Stored Cross-Site Scripting
≤4.4.6Update to 4.4.7
- High7.2Unauthenticated Stored Cross-Site Scripting
≤4.4.3Update to 4.4.4
- High7.2Unauthenticated Stored Cross-Site Scripting via 'wpl_user_preference' Parameter
≤4.4.1Update to 4.4.2
- Critical9.8Unauthenticated Arbitrary File Upload via 'upload-logo' REST Endpoint
≤4.4.1Update to 4.4.2
- Critical9.8Unauthenticated Arbitrary File Upload
≤4.4.1Update to 4.4.2
- High7.2Authenticated (Subscriber+) Stored Cross-Site Scripting via 'regionArray' Parameter
≤4.3.5Update to 4.4.0
- High7.5Missing Authorization to Sensitive Information Exposure
≤4.1.2Update to 4.1.3
- High7.2Unauthenticated Stored Cross-Site Scripting via Client-IP header
≤3.2.0Update to 3.3.0
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode: common questions
Does WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode have known vulnerabilities?
Yes. VulnCrest Radar lists 28 known vulnerabilities in WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode: 2 critical, 6 high, 20 medium. At least one is not fixed in the latest version.
How do I check which version of WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode vulnerability?
CVE-2026-42636, published Oct 5, 2026: WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode <= 4.4.6 - Unauthenticated Stored Cross-Site Scripting. Severity: High (CVSS 7.2).
Is any WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode vulnerability listed in CISA KEV?
No. None of the known WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode vulnerabilities is currently listed in the CISA KEV catalog.