CVE-2019-16522 - The eu-cookie-law plugin through 3.0.6 for WordPress (aka EU Cookie Law (GDPR)) is susceptible to Stored XSS due to improper encoding of several configuration options in the admin area and the displayed cookie consent message

Back Back to CVE browser

MEDIUM

The eu-cookie-law plugin through 3.0.6 for WordPress (aka EU Cookie Law (GDPR)) is susceptible to Stored XSS due to improper encoding of several configuration options in the admin area and the displayed cookie consent message

Published Oct 16, 2019

4.8

MEDIUM

CVSS 3.1

EPSS 1.03%

Description

The eu-cookie-law plugin through 3.0.6 for WordPress (aka EU Cookie Law (GDPR)) is susceptible to Stored XSS due to improper encoding of several configuration options in the admin area and the displayed cookie consent message. This affects Font Color, Background Color, and the Disable Cookie text. An attacker with high privileges can attack other users.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-7199
Advisory
https://github.com/sbaresearch/advisories/tree/public/2019/SBA-ADV-20190913-01_WordPress_Plugin_EU_Cookie_Law
x_refsource_MISCExploitThird Party Advisory
https://wordpress.org/plugins/eu-cookie-law/#developers
x_refsource_MISCProductThird Party Advisory
https://wpvulndb.com/vulnerabilities/9918
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-7199		Advisory
https://github.com/sbaresearch/advisories/tree/public/2019/SBA-ADV-20190913-01_WordPress_Plugin_EU_Cookie_Law		x_refsource_MISCExploitThird Party Advisory
https://wordpress.org/plugins/eu-cookie-law/#developers		x_refsource_MISCProductThird Party Advisory
https://wpvulndb.com/vulnerabilities/9918		x_refsource_MISCThird Party Advisory