CVE-2021-24569

The Cookie Notice & Compliance for GDPR / CCPA WordPress plugin before 2.1.2 does not escape the value of its Button Text setting when outputting it in an attribute in the frontend, allowing high privilege users such as admin to perform Cross-Site Scripting even when the unfiltered_html capability is disallowed.

CVSS v3.1

4.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS

0.62% chance of exploitation in the next 30 days, 47th percentile

Published

2021-09-27

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/38053e05-4b17-4fa9-acd3-85d8529b202b

References

• CVE Record
• NVD entry

Related

• CVE-2021-24568
• CVE-2021-24570
• CVE-2021-24567
• CVE-2021-24571
• CVE-2021-24566
• CVE-2021-24572