USERCENTRICS CMP
USERCENTRICS CMP has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 4.4, and the most serious one scores 4.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for USERCENTRICS CMP has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by Nabil Irawan. USERCENTRICS CMP is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 5.8.15.
CVE-2025-62920USERCENTRICS CMP <= 1.0.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records
USERCENTRICS CMP
Author
webnique
Official Usercentrics WordPress Plugin This is the official Usercentrics WordPress Plugin. Automatically embed the Usercentrics Consent Management Platform. All you need to do is enter your Settings ID. Automatic Usercentrics CMP embedding (just enter your personal Settings ID). Option to also embed your Google Tag Manager Container (just enter your Google Tag Manager Container ID). Automatic Language detection. Provides a shortcode to list all of your data privacy relevant tags anywhere you want.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C