CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2023-49191 – WordPress GDPR Cookie Consent by Supsystic Plugin <= 2.1.2 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-49191
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Supsystic GDPR Cookie Consent by Supsystic allows Stored XSS.This issue affects GDPR Cookie Consent by Supsystic: from n/a through 2.1.2. La vulnerabilidad de neutralización inadecuada de la entrada durante la generación de páginas web ("Cross-site Scripting") en Supsystic GDPR Cookie Consent by Supsystic permite almacenar XSS. Este problema afecta a GDPR Cookie Consent by Supsystic: desde n/a hasta 2.1.2. The GDPR Cookie Consent by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://patchstack.com/database/vulnerability/gdpr-compliance-by-supsystic/wordpress-gdpr-cookie-consent-by-supsystic-plugin-2-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2020-20633 – GDPR Cookie Consent & Compliance Notice <= 1.8.2 - Authenticated Stored Cross-Site Scripting and Authorization Bypass
https://notcve.org/view.php?id=CVE-2020-20633
ajax_policy_generator in admin/modules/cli-policy-generator/classes/class-policy-generator-ajax.php in GDPR Cookie Consent (cookie-law-info) 1.8.2 and below plugin for WordPress, allows authenticated stored XSS and privilege escalation. La función ajax_policy_generator en el archivo admin/modules/cli-policy-generator/classes/class-policy-generator-ajax.php en el plugin GDPR Cookie Consent (cookie-law-info) versiones 1.8.2 y por debajo para WordPress, permite un ataque de tipo XSS almacenado autenticado y una escalada de privilegios . • https://blog.nintechnet.com/wordpress-gdpr-cookie-consent-plugin-fixed-vulnerability • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •