PT-2025-11303 · WordPress · Gdpr Cookie Compliance

Dmitry Ignatyev · Published 2025-03-12 · Updated 2025-03-16 · CVE-2025-1622

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: GDPR Cookie Compliance WordPress plugin versions prior to 4.15.7

Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks due to insufficient input sanitization and output escaping of some settings. This can occur even when the unfiltered html capability is disallowed, for example, in multisite setups. Authenticated attackers with administrator-level permissions can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Recommendations: For versions prior to 4.15.7, update to version 4.15.7 or later to resolve the issue. As a temporary workaround, consider restricting access to admin settings to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-1622

Affected Products

Gdpr Cookie Compliance

References · 8

• 🔥 https://wpscan.com/vulnerability/7a903d61-2792-4fe0-a26b-f400f4a3124b · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-1622 · Security Note
• https://osv.dev/vulnerability/CVE-2025-1622 · Vendor Advisory
• https://t.me/cvenotify/114951 · Telegram Post
• https://t.me/cvedetector/20406 · Telegram Post
• https://t.me/cvenotify/114411 · Telegram Post
• https://twitter.com/CVEnew/status/1901155995566698734 · Twitter Post
• https://t.me/cvetracker/19222 · Telegram Post