Termageddon: Cookie Consent & Privacy Compliance
Termageddon: Cookie Consent & Privacy Compliance has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Termageddon: Cookie Consent & Privacy Compliance has a vendor fix available, so running the current release closes it.
All of these findings were reported by zaim. Termageddon: Cookie Consent & Privacy Compliance is installed on roughly 8,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2025-58026Termageddon: Cookie Consent & Privacy Compliance <= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records
Termageddon: Cookie Consent & Privacy Compliance
Author
termageddon
The most comprehensive cookie consent solution for WordPress. Automatically show consent banners based on visitor location with smart geolocation targeting. TERMAGEDDON: CONSENT SOLUTION This plugin is designed to help WordPress website owners quickly install the Termageddon consent solution onto their website. Why choose Termageddon Cookie Consent? Smart Geolocation: Automatically detect visitor locations and show consent banners only when required More coverage than any other provider: Termageddon covers privacy laws such as GDPR, CPRA, UK DPA, PIPEDA (Canada), Quebec 25, VCDPA, Australia Privacy Act, CIPA, and many, many more laws. Lightning Fast: AJAX-powered location detection maintains site speed and caching compatibility Divi support: Ensure the consent loads for end users, while preventing loading for logged in admins (to ensure Divi’s Visual Builder is unaffected). Professional Support: Dedicated support team ready to help 🌍 Global Privacy Law Support Termageddon’s Auto-updating website policies and consent solution supports major privacy regulations worldwide: 🇪🇺 European Union & EEA – GDPR 🇬🇧 United Kingdom – UK DPA 🇨🇦 Canada – PIPEDA & Quebec Law 25 🇺🇸 United States – State-specific regulations: California – CPRA, CalOPPA & CIPA Colorado – CPA Connecticut – CTDPA Florida Montana – MCDPA New Jersey – NJDPA Oregon – OCPA Texas – TDPSA Utah – UCPA Virginia – VCDPA And more. 🚀 Key Features Smart Geolocation Targeting Termageddon Hosted Geolocation: Browser-side location detection through geo.termageddon.com without storing a large database on your WordPress server Cache Compatible: Maintain full-page caching while accurately applying your configured region rules Cookie Optimization: Reduce server load with intelligent cookie-based location caching Debug Mode: Test and troubleshoot geolocation with built-in debugging tools Seamless Integration WordPress Integration: Works with any WordPress theme and popular page builders Usercentrics Powered: Built on the industry-leading Usercentrics consent platform Developer Friendly: Extensive hooks, filters, and customization options Performance Optimized: Minimal impact on site speed and Core Web Vitals Advanced Video Integrations Divi Video: Enhanced image overlay placeholder handling Elementor Video: Seamless consent integration with Elementor video widgets PowerPack Video: Support for BeaverBuilder PowerPack video embeds Presto Player: Optimized consent handling for Presto Player Ultimate Addons: Support for Beaver Builder Ultimate Addons Privacy Settings Management Flexible Shortcode: [uc-privacysettings] with extensive customization options Button & Link Support: Choose between button or anchor elements Custom Styling: Full control over appearance with CSS targeting Automatic Replacement: Intelligent detection and replacement of privacy settings elements 📋 Shortcode Usage Place privacy settings links anywhere on your site with the powerful shortcode: [uc-privacysettings] [uc-privacysettings text="Privacy Preferences"] [uc-privacysettings type="button" text="Manage Cookies"] Supported Parameters: * type – Element type: “a” (default) or “button” * text – Display text (default: “Privacy Settings”) * Styling via #usercentrics-psl CSS ID 🔧 Advanced Configuration Provider Management Disable Blocking: Selectively disable cookie blocking for specific providers Auto-Refresh: Configure automatic page reload on consent for supported providers Custom Integrations: Extend functionality with custom provider configurations Performance Optimization CDN Configuration: Optional CDN bypass for translations Priority Control: Adjust script loading priority for optimal performance Preconnect Control: Optionally remove the Usercentrics preconnect and preload links while keeping the consent scripts active Cache Compatibility: Full support for popular caching plugins Troubleshooting Mode: Disable for all users except when using ?enable-usercentrics 🛡️ Privacy & Data Protection Important Privacy Notice: When GeoIP is enabled, a visitor’s browser requests location information from geo.termageddon.com so the plugin can determine the appropriate consent experience. The hosted service returns country, region, and city information. The plugin stores that location result in a first-party browser cookie for up to 365 days and stores its show-or-hide decision in a session cookie. Data Minimization: Location data is used only to apply the region selections configured in this plugin. If hosted geolocation cannot be reached, the consent widget is shown by default. Compliance First: Ensure you are in compliance with all applicable privacy laws before installing this plugin or any tracking technologies. Support For comprehensive support and assistance: Help Center: Visit our support portal for detailed documentation Community Forum: Get help from other users on WordPress.org support forums Priority Support: Termageddon customers receive priority email support Developer Resources: Access our developer documentation for advanced customizations
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C