WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode

WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode has 28 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; all 28 are fixed as of October 2026. Their average CVSS score is 5.8, and the most serious one scores 9.8 out of 10. Severity breakdown: 2 critical and 6 high. 2026 was the busiest year with 18 disclosures.

The most common weakness is Missing Authorization, behind 13 of the records (46%). Other recurring categories include Improper Neutralization Of Input During Web Page Generation, Cross-Site Request Forgery.

Every one of the 28 issues recorded for WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode has a vendor fix available, so running the current release closes all known holes.

18 independent researchers contributed these findings, most of them (4) reported by Wordfence PRISM. WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode is installed on roughly 9,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.4.

01234567891002.08.2019Today04.03.20226.3Freemius SDK <= 2.4.2 - Missing Authorization Checks CVSS 6.3 · 04.03.202220.06.20236.4WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 2.2.5 - Authenticated(Administrator+) CSV Injection CVSS 6.4 · 20.06.202316.04.20245.3WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) <= 3.0.2 - Missing Authorization to Unauthenticated Arbitrary Post Deletion CVSS 5.3 · 16.04.202425.06.20247.2WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) <= 3.2.0 - Unauthenticated Stored Cross-Site Scripting via Client-IP header CVSS 7.2 · 25.06.202411.12.20244.3Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) <= 3.6.5 - Missing Authorization to Authenticated (Subscriber+) Whitelist Script CVSS 4.3 · 11.12.202405.06.20254.3WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 3.8.0 - Cross-Site Request Forgery CVSS 4.3 · 05.06.202508.11.20254.3Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.0.3 - Missing Authorization CVSS 4.3 · 08.11.202515.12.20255.3Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.0.7 - Missing Authorization CVSS 5.3 · 15.12.202516.12.20255.3Cookie Banner, Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) : WP Cookie Consent <= 4.0.7 - Missing Authorization to Unauthenticated Arbitrary Post Deletion CVSS 5.3 · 16.12.202530.12.20255.3Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.0.3 - Missing Authorization CVSS 5.3 · 30.12.202518.02.20267.5Cookie Banner, Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) : WP Cookie Consent <= 4.1.2 - Missing Authorization to Sensitive Information Exposure CVSS 7.5 · 18.02.202602.07.20264.9Cookie Banner for GDPR / CCPA <= 4.3.5 - Authenticated (Administrator+) SQL Injection via 's' Parameter CVSS 4.9 · 02.07.202609.07.20264.3Cookie Banner for GDPR / CCPA <= 4.3.6 - Missing Authorization to Authenticated (Subscriber+) Scan Schedule Modification via gcc_save_schedule_scan AJAX Action CVSS 4.3 · 09.07.20264.9Cookie Banner for GDPR / CCPA <= 4.3.6 - Authenticated (Administrator+) SQL Injection via 'scan_id' Parameter CVSS 4.9 · 09.07.202627.07.20264.3Cookie Banner for GDPR / CCPA – WPLP Cookie Consent <= 4.3.7 - Cross-Site Request Forgery via Bulk Action to Delete/Resolve Entries CVSS 4.3 · 27.07.202614.08.20267.2Cookie Banner for GDPR / CCPA <= 4.3.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'regionArray' Parameter CVSS 7.2 · 14.08.202618.08.20266.4WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode <= 4.3.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVSS 6.4 · 18.08.202631.08.20269.8WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode <= 4.4.1 - Unauthenticated Arbitrary File Upload CVSS 9.8 · 31.08.20269.8WPLP Cookie Consent <= 4.4.1 - Unauthenticated Arbitrary File Upload via 'upload-logo' REST Endpoint CVSS 9.8 · 31.08.202604.09.20264.9WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode < 4.4.2 - Authenticated (Administrator+) SQL Injection CVSS 4.9 · 04.09.202607.09.20264.3WPLP Cookie Consent <= 4.4.1 - Missing Authorization CVSS 4.3 · 07.09.20264.3WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode 4.0.2 - 4.4.1 - Missing Authorization to Information Exposure CVSS 4.3 · 07.09.20264.3WPLP Cookie Consent <= 4.4.1 - Missing Authorization CVSS 4.3 · 07.09.20265.3WPLP Cookie Consent <= 4.4.1 - Missing Authorization CVSS 5.3 · 07.09.202608.09.20267.2Cookie Banner for GDPR / CCPA <= 4.4.1 - Unauthenticated Stored Cross-Site Scripting via 'wpl_user_preference' Parameter CVSS 7.2 · 08.09.202614.09.20264.3WPLP Cookie Consent <= 4.4.3 - Cross-Site Request Forgery CVSS 4.3 · 14.09.202615.09.20267.2WPLP Cookie Consent <= 4.4.3 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 15.09.202605.10.20267.2WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode <= 4.4.6 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 05.10.2026

Strategic Overview

Avg CVSSMedium
5.8/ 10
Patch Coverage100%
Open

0

Fixed

28

Get automatic notifications for all WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2026-75865

WPLP Cookie Consent <= 4.4.1 - Unauthenticated Arbitrary File Upload via 'upload-logo' REST Endpoint

Read the full analysis

Vulnerability Records

28 records
2026-10-05 16:20CVE-2026-42636
7.2
High
Nguyen Kim SangYes
2026-09-15 00:00CVE-2026-85130
7.2
High
Karthik RamakrishnanYes
2026-09-14 00:00CVE-2026-85131
4.3
Medium
Karthik RamakrishnanYes
2026-09-08 19:57CVE-2026-14989
7.2
High
Naoya Takahashi (nakko)Yes
2026-09-07 00:00CVE-2026-82185
4.3
Medium
RIA LabsYes
2026-09-07 00:00CVE-2026-85132
4.3
Medium
Karthik RamakrishnanYes
2026-09-07 00:00CVE-2026-85133
4.3
Medium
Naoki KawahigashiYes
2026-09-07 00:00CVE-2026-82184
5.3
Medium
Alex SpataruYes
2026-09-04 00:00CVE-2026-82186
4.9
Medium
cyberkareemYes
2026-08-31 14:24CVE-2026-75865
9.8
Critical
Supakiad S. (m3ez)Yes
Showing 1–10 of 28 reports
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode banner
Latestv4.4.8

WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode

WP Legal Pages

Author

WP Legal Pages

4.6(51)
92/100
Last Updated
2026-10-27 (2d ago)
Active Installs
9,000+
Downloads
691,720
Requires WP
6.2+
Requires PHP
7.4+
Tested up to
WP 7.1.4
Created
2019-08-02 (7y ago)

GDPR and CCPA cookie consent banner for WordPress. Block tracking scripts until visitors say yes. WPLP Cookie Consent is a cookie consent plugin and consent management platform (CMP). It adds a cookie banner (also called a cookie notice) to your site, scans for cookies, blocks tracking scripts until consent, and logs every consent decision in your own WordPress database. ✅ Free: cookie banner, cookie scanner, script blocking, and consent logs ✅ Google Certified CMP, with Google Consent Mode v2 on every plan ✅ IAB TCF v2.4 certified, on paid plans ✅ One login for every client site, with the WPLP web app Try it first in the Live Preview. 🛑 The problem with most cookie banners A lot of cookie banners show a message and stop there. Google Analytics, Meta Pixel, and ad tags still load before the visitor clicks anything, and there is no record of what the visitor chose. WPLP Cookie Consent holds those scripts back until the visitor gives consent. Then it saves the decision with a date and time, so you have a record if a visitor or a regulator asks. ⚡ How it works Install and activate. The cookie banner goes live. Run a cookie scan. The cookie scanner finds cookies and third-party scripts and sorts them into categories: necessary, analytics, marketing, and so on. Choose what to block. Check the results and pick which scripts wait for consent. Publish. Blocked scripts load only after the visitor accepts that category. Every choice is logged. A step-by-step setup wizard walks you through each step, on every plan. 🏢 Built for agencies and multiple client sites Logging in to each client site to check a cookie banner works for 3 sites. It stops working at 30. Manage cookie consent for every client site from one login. The WPLP web app (app.wplegalpages.com) comes with every plan, Free included. It has every feature of this plugin, plus multi-site management. One login for every client site: add each site and manage cookie consent from one place, up to your plan’s site limit. No WordPress Multisite needed: each client site keeps its own WordPress install. If you do run a Multisite network, the plugin works there too. Every site’s status in one list: scan status, consent logs, and legal page coverage for the whole roster. Copy a banner setup to the next client: export cookie settings from one site and import them into another (paid plans). Your brand on client sites: remove WPLP branding and add your own logo (paid plans). One setup for visitors from different regions: auto-detect law reads each visitor’s location and shows the matching banner, GDPR to an EU visitor and CCPA to a California visitor (paid plans). Same features on every paid plan Professional, Business, and Agency have every feature, with no traffic or usage limits. The price changes only with the number of sites, so a client’s traffic spike doesn’t change your bill. Free: 1 site Professional: up to 3 sites Business: up to 10 sites Agency: 25, 50, or 100 sites See the pricing page. 🧰 Free features Cookie banner Bar, box, and popup layouts, plus ready-made banner templates Your own text, colors, and custom CSS Accept and Reject buttons on the first layer Preference center with consent by category and by service “Do Not Sell or Share My Personal Information” link for CCPA/CPRA Banner language that matches the visitor’s browser language (50+ languages) Hide the banner on pages you choose A/B testing for banner designs Banner design that follows WCAG and ADA accessibility guidelines Cookie scanner 5 automated cookie scans a month, up to 100 pages per scan Finds cookies from common services and plugins and sorts them into categories Sends results to your cookie policy through the WPLP Cookie Policy Details and WPLP Autoupdate Cookies List blocks Add or edit cookies by hand at any time Script and embed blocking Blocks Google Analytics, Google Ads, Meta Pixel, Microsoft Clarity, TikTok Pixel, LinkedIn Insight Tag, and more until consent Blocks embedded YouTube, Vimeo, Google Maps, and social media content until consent Works for scripts added in theme code, by plugins, or through Google Tag Manager Whitelist scripts that must always load Consent logs and signals Every consent decision is saved in your WordPress database: status, category, date, and time Visitors can change or withdraw consent at any time Ask visitors for consent again on a schedule you set Google Consent Mode v2 Global Privacy Control and Do Not Track signals WP Consent API support Data requests (DSAR) A request form for visitors who want to access or delete their data, added with a shortcode Email alerts and a request queue in your dashboard Free plan limit: 1 site and up to 20,000 banner pageviews a month. After 20,000 pageviews, the banner stops showing until the next month, or until you move to a paid plan. 💎 Every paid plan (Professional, Business, and Agency) Buy a paid plan and every pro feature turns on in this same plugin. You don’t reinstall anything or move data. Compare plans and prices. IAB TCF v2.4 for sites that run programmatic ads Auto-detect law, with more laws: ePrivacy, UK GDPR, PIPEDA (Canada), PDPL (Saudi Arabia), APP (Australia), and 19 US state privacy laws Geo-targeting: show or hide the banner by visitor region Automated DSAR processing: find a requester’s data in WordPress, WooCommerce, and consent logs, then export or delete it after you confirm Export and import cookie settings between sites Custom logo and WPLP branding removal Unlimited cookie scans and pageviews A weekly cookie scan, turned on by default Priority support ⚖️ Privacy laws covered Free plan GDPR (EU) CCPA/CPRA (California) LGPD (Brazil) COPPA (US) Paid plans add ePrivacy Directive (EU) UK GDPR PIPEDA (Canada), PDPL (Saudi Arabia), and APP (Australia) 19 US state privacy laws, including VCDPA (Virginia) Note: privacy laws change, and each one asks for different things. WPLP Cookie Consent gives you the tools to collect and record consent. It doesn’t give legal advice. Talk to a lawyer about your own situation. 👥 Who uses WPLP Cookie Consent Agencies and freelancers: one banner setup copied across client sites, managed from one login Blogs and content sites: analytics and ad scripts held until consent, with Google Consent Mode v2 for Google tags WooCommerce stores: marketing pixels blocked until consent, and data requests handled from the dashboard Sites with visitors from many countries: auto-detect law shows each visitor the banner for their region (paid plans) Sites that run programmatic ads: IAB TCF v2.4 (paid plans) 🔌 Compatibility Page builders and editors: Elementor, Divi, Gutenberg Ecommerce: WooCommerce, Easy Digital Downloads Tags and forms: Google Tag Manager, WPForms, Gravity Forms, Contact Form 7 Translation: WPML, Polylang WordPress Multisite: works on Multisite networks 📄 Add your legal pages too Your cookie banner should link to a cookie policy and a privacy policy. WPLP Legal Pages is our free plugin that creates them, from the same team. Both plugins are part of the WPLP Compliance Platform. 🌐 External services Consent records and settings are stored in your WordPress database. Some features connect to services run by WPLP: Cookie scanning service. When you run a cookie scan, the plugin sends the URLs of the pages to scan to WPLP’s scanning service. The service finds the cookies and scripts on those pages, sorts them into categories, and sends the results back to your site. WPLP web app (app.wplegalpages.com). This connection starts only if you connect your site to the web app. Your consent records then sync to your WPLP account, so you can manage the site with your other sites. License checks. On paid plans, the plugin checks your license key with WPLP. WPLP doesn’t sell visitor data or share it with advertisers. WPLP Terms of Use WPLP Privacy Policy 📚 Documentation and support WPLP website Pricing Overview Compliance Setup Wizard Guides FAQs Support forum Contact the WPLP team

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C