WordPress plugin
Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical0
- High0
- Medium8
- Low0
All Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium5.3 | Missing Authorization ≤1.4.6Update to 1.4.7 | CVE-2025-66077 | |
| Medium4.3 | Missing Authorization ≤1.4.5Update to 1.4.6 | CVE-2025-48242 | |
| Medium4.3 | Cross-Site Request Forgery ≤1.4.2Update to 1.4.3 | CVE-2024-32451 | |
| Medium5.4 | Cross-Site Request Forgery via moveToTrash and fetch_and_insert_template_data ≤1.3.8Update to 1.3.9 | CVE-2023-47824 | |
| Medium4.3 | Missing Authorization ≤1.3.8Update to 1.3.9 | — | |
| Medium4.3 | Missing Authorization on 'deleteLegalTemplate' <1.3.8Update to 1.3.8 | CVE-2023-50886 | |
| Medium4.3 | Missing Authorization ≤3.6.0Update to 3.6.1 | — | |
| Medium4.3 | Cross-Site Request Forgery ≤3.6.0Update to 3.6.1 | CVE-2022-47150 |
- Medium5.3Missing Authorization
≤1.4.6Update to 1.4.7
- Medium4.3Missing Authorization
≤1.4.5Update to 1.4.6
- Medium4.3Cross-Site Request Forgery
≤1.4.2Update to 1.4.3
- Medium5.4Cross-Site Request Forgery via moveToTrash and fetch_and_insert_template_data
≤1.3.8Update to 1.3.9
- Medium4.3Missing Authorization
≤1.3.8Update to 1.3.9
- Medium4.3Missing Authorization on 'deleteLegalTemplate'
<1.3.8Update to 1.3.8
- Medium4.3Missing Authorization
≤3.6.0Update to 3.6.1
- Medium4.3Cross-Site Request Forgery
≤3.6.0Update to 3.6.1
Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator: common questions
Does Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator have known vulnerabilities?
Yes. VulnCrest Radar lists 8 known vulnerabilities in Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator: 8 medium. At least one is not fixed in the latest version.
How do I check which version of Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator vulnerability?
CVE-2025-66077, published Nov 21, 2025: Legal Pages <= 1.4.6 - Missing Authorization. Severity: Medium (CVSS 5.3).
Is any Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator vulnerability listed in CISA KEV?
No. None of the known Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator vulnerabilities is currently listed in the CISA KEV catalog.