{"id":"CVE-2025-2205","aliases":["EUVD-2025-7539","GHSA-vmg5-6fp3-rr56"],"status":"published","title":"GDPR Cookie Compliance \u003c= 4.15.6 - Authenticated (Admin+) Stored Cross-Site Scripting","description":"The GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice – CCPA, DSGVO, RGPD plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.15.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.","severity":{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00447,"percentile":0.3915,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2025-03-12T03:21:26Z","modified":"2026-06-17T09:06:31Z","products":[{"vendor":"mooveagency","product":"gdpr cookie compliance – cookie banner, cookie consent, cookie notice for ccpa, eu cookie law"},{"vendor":"mooveagency","product":"gdpr_cookie_compliance"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37da32e4-48a1-4830-a47c-c454d60c9811?source=cve","tags":["Third Party Advisory"]},{"url":"https://wpscan.com/vulnerability/7a903d61-2792-4fe0-a26b-f400f4a3124b/","tags":["Exploit","Third Party Advisory"]},{"url":"https://research.cleantalk.org/cve-2025-1622/","tags":["Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2205"},{"url":"https://research.cleantalk.org/cve-2025-1622"},{"url":"https://wpscan.com/vulnerability/7a903d61-2792-4fe0-a26b-f400f4a3124b"},{"url":"https://github.com/advisories/GHSA-vmg5-6fp3-rr56"}],"sources":{"cve":[{"id":"CVE-2025-2205","title":"GDPR Cookie Compliance \u003c= 4.15.6 - Authenticated (Admin+) Stored Cross-Site Scripting","description":"The GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice – CCPA, DSGVO, RGPD plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.15.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.","status":"published","published":"2025-03-12T03:21:26.642Z","modified":"2026-04-08T16:46:25.963Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:38.70481Z"}],"euvd":[{"id":"EUVD-2025-7539","description":"The GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice – CCPA, DSGVO, RGPD plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.15.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.","status":"published","published":"2025-03-12T03:21:26Z","modified":"2026-04-08T16:46:25Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:25:03.268135Z"}],"ghsa":[{"id":"GHSA-vmg5-6fp3-rr56","title":"The GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice – CCPA, DSGVO, RGPD...","description":"The GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice – CCPA, DSGVO, RGPD plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.15.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.","status":"published","published":"2025-03-12T06:32:42Z","modified":"2025-03-12T06:32:47Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:00:15.034834Z"}],"nvd":[{"id":"CVE-2025-2205","description":"The GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice – CCPA, DSGVO, RGPD plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.15.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.","status":"published","published":"2025-03-12T04:15:19.81Z","modified":"2026-06-17T09:06:31.94Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:53.93104Z"}]}}