CVE-2026-42636

WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent

Published 6 Oct 2026 · updated 6 Oct 2026 · Deferred

7.1 High · CVSS 3.1, patchstack.com

Description

Unauthenticated Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.4.6 versions.

References

patchstack.com/database/wordpress/plugin/gdpr-cookie-consent/vulnerability/wordpress-wp-cookie-notice-for-gdpr-ccpa-eprivacy-consent-plugin-4-4-6-cross-site-scripting-xss-vulnerability?_s_id=cve