Cookie Notice & Consent
Cookie Notice & Consent has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2025; all 3 are fixed as of September 2026. Their average CVSS score is 6.3, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 2 high. 2025 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Scripting, behind 2 of the records (67%). Other recurring categories include Improper Neutralization Of Script-Related HTML Tags In A Web Page (Basic XSS).
Every one of the 3 issues recorded for Cookie Notice & Consent has a vendor fix available, so running the current release closes all known holes.
3 independent researchers contributed these findings, one record each. Cookie Notice & Consent is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.8.8.
CVE-2025-10496Cookie Notice & Consent <= 1.6.5 - Unauthenticated Stored Cross-Site Scripting
Read the full analysisVulnerability Records
Cookie Notice & Consent
Author
christophrado
Cookie Notice & Consent makes it easy for you to collect consent for the usage of cookies. It lets you define different cookie categories and display them within a notice banner. Ready-made themes for the cookie notice banner makes it easy for non-technical users to get started. Users can select which categories to consent with. Consent logs are stored (optional). Scripts will be output and executed only after the user has accepted the respective categories. Cookie Notice & Consent aims to help you comply with local privacy laws like GDPR/DSGVO. It does not offer a one-click solution though. Please set up your website properly and carefully to comply with applicable laws. Developer focus Please note that Cookie Notice & Consent is generally geared towards developers and technically savvy site administrators. Although it does provide pre-made themes, the plugin does not provide separate options for individual design aspects, and does not plan to provide those in the future. It is up to the developer/administrator to add further styling to match the theme using CSS. This plugin does not add any branding (neither visually nor textually), top-level admin menu items or user-facing indicators. It aims to be usable in client projects by blending in with WordPress core appearance, naming and settings. Settings screens are visible to administrator level users only. What this plugin does not provide Beyond the pre-made, as-is themes, this plugin does not offer styling options via the settings screen (please contact your webdev for further design customization) This plugin does not provide scanning for, detecting or automatic blocking content like embeds, scripts or cookies Shortcodes and functions This plugin currently provides the following shortcodes and public functions: Shortcode [revoke_cookie_consent]: Outputs a revoke consent button that clears the consent cookie Shortcode [cookie_consent_status]: Outputs a formatted string indicating the users consent choice Function is_cookie_consent_set(): Returns whether the consent has been set by the user Function is_cookie_category_accepted( $category ): Returns whether the given cookie category has been accepted by the user (valid values: essential, functional, marketing) Disclaimer This plugin does not represent legal advice and assumes no liability whatsoever. Please obtain proper advice from real lawyers if in doubt.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C