CVE-2026-82185
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The WPLP Cookie Consent WordPress plugin before version 4.4.2 does not have capability or nonce checks on some of its A/B testing actions, allowing any authenticated user, such as a subscriber, to overwrite the cookie banner configuration shown to every visitor and to irreversibly reset the stored A/B test results.
Risk Assessment
An attacker can alter the cookie banner configuration, potentially violating privacy regulations, and destroy A/B test data, impacting marketing decisions.
Recommendation
Update the WPLP Cookie Consent plugin to version 4.4.2 or later, which includes fixes for access control and nonce checks.
Other vulnerabilities in WPLP Cookie Consent
See all- CVE-2026-75865Critical
The WPLP Cookie Consent plugin for WordPress up to version 4.4.1 is vulnerable to arbitrary file upload due to missing file type validation in the saas_upload_logo() function combined with an authorization bypass on the WPLP connector REST endpoints. This allows unauthenticated attackers to upload arbitrary files on the server, potentially leading to remote code execution.
- CVE-2026-85131Medium
The WPLP Cookie Consent WordPress plugin before 4.4.4 does not perform CSRF or capability checks when processing bulk actions on its administration screens, and does not restrict the targeted items to its own records. This allows attackers to make a logged in admin permanently delete arbitrary posts and pages via a crafted request.
- CVE-2026-14989High
The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress up to version 4.4.1 is vulnerable to Stored Cross-Site Scripting via the 'wpl_user_preference' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page.
- CVE-2026-82184Medium
The WPLP Cookie Consent WordPress plugin before version 4.4.2 does not have any authorisation or CSRF checks when storing visitor consent state, and the code that does so runs on every front-end page load, allowing unauthenticated attackers to overwrite a site-wide option with arbitrary data.
- CVE-2026-82186Medium
The WPLP Cookie Consent WordPress plugin before version 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks.
- CVE-2026-14475Medium
The Cookie Banner for GDPR/CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to generic SQL injection via the 'scan_id' parameter in all versions up to and including 4.3.6 due to insufficient escaping and lack of query preparation. This allows authenticated attackers with administrator-level access or higher to append additional SQL queries to existing ones.
- CVE-2026-12920Medium
The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to generic SQL injection via the 's' parameter in all versions up to and including 4.3.5. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. Authenticated attackers with administrator-level access and above can append additional SQL queries to extract sensitive information from the database.
Original NVD description (English source)
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have capability or nonce checks on some of its A/B testing actions, allowing any authenticated user, such as a subscriber, to overwrite the cookie banner configuration shown to every visitor and to irreversibly reset the stored A/B test results.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS