Missing Authorization in Cookie Notice Cache Purge and AJAX Handlers

Skrevet den af i Cookie Notice & Compliance for GDPR / CCPA

Cookie Notice does not verify the current user’s capabilities before running several state-changing actions. The cache purge triggered by the hu_purge_cache frontend parameter requires no authentication at all, letting any visitor force repeated configuration requests to the vendor platform. Two admin AJAX handlers, the privacy consent form status and the conditional rule group values, also omit the capability check. Any site running Cookie Notice 2.5.10 or older is affected.

This vulnerability affects the following application versions:

  • Cookie Notice & Compliance for GDPR / CCPA 1.4.12
  • Cookie Notice & Compliance for GDPR / CCPA 2.0.0
  • Cookie Notice & Compliance for GDPR / CCPA 2.0.1
  • Cookie Notice & Compliance for GDPR / CCPA 2.0.2
  • Cookie Notice & Compliance for GDPR / CCPA 2.0.3
  • Cookie Notice & Compliance for GDPR / CCPA 2.0.4
  • Cookie Notice & Compliance for GDPR / CCPA 2.1.0
  • Cookie Notice & Compliance for GDPR / CCPA 2.1.1
  • Cookie Notice & Compliance for GDPR / CCPA 2.1.2
  • Cookie Notice & Compliance for GDPR / CCPA 2.1.3
  • Cookie Notice & Compliance for GDPR / CCPA 2.1.4
  • Cookie Notice & Compliance for GDPR / CCPA 2.1.5
  • Cookie Notice & Compliance for GDPR / CCPA 2.2.0
  • Cookie Notice & Compliance for GDPR / CCPA 2.2.1
  • Cookie Notice & Compliance for GDPR / CCPA 2.2.2
  • Cookie Notice & Compliance for GDPR / CCPA 2.2.3
  • Cookie Notice & Compliance for GDPR / CCPA 2.3.0
  • Cookie Notice & Compliance for GDPR / CCPA 2.3.1
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.0
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.1
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.2
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.3
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.4
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.5
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.6
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.7
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.8
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.9
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.10
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.11
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.11.1
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.13
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.14
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.15
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.16
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.17
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.17.1
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.18
  • Cookie Notice & Compliance for GDPR / CCPA 2.5.0
  • Cookie Notice & Compliance for GDPR / CCPA 2.5.0.1
  • Cookie Notice & Compliance for GDPR / CCPA 2.5.1
  • Cookie Notice & Compliance for GDPR / CCPA 2.5.2
  • Cookie Notice & Compliance for GDPR / CCPA 2.5.3
  • Cookie Notice & Compliance for GDPR / CCPA 2.5.4
  • Cookie Notice & Compliance for GDPR / CCPA 2.5.5
  • Cookie Notice & Compliance for GDPR / CCPA 2.5.6
  • Cookie Notice & Compliance for GDPR / CCPA 2.5.7
  • Cookie Notice & Compliance for GDPR / CCPA 2.5.8
  • Cookie Notice & Compliance for GDPR / CCPA 2.5.9
  • Cookie Notice & Compliance for GDPR / CCPA 2.5.10

Stored XSS vulnerability in shortcode

Skrevet den af i Cookie Notice & Compliance for GDPR / CCPA

Stored XSS vulnerability in [cookies_accepted] shortcode via HTML

This vulnerability affects the following application versions:

  • Cookie Notice & Compliance for GDPR / CCPA 2.0.0
  • Cookie Notice & Compliance for GDPR / CCPA 2.0.1
  • Cookie Notice & Compliance for GDPR / CCPA 2.0.2
  • Cookie Notice & Compliance for GDPR / CCPA 2.0.3
  • Cookie Notice & Compliance for GDPR / CCPA 2.0.4
  • Cookie Notice & Compliance for GDPR / CCPA 2.1.0
  • Cookie Notice & Compliance for GDPR / CCPA 2.1.1
  • Cookie Notice & Compliance for GDPR / CCPA 2.1.2
  • Cookie Notice & Compliance for GDPR / CCPA 2.1.3
  • Cookie Notice & Compliance for GDPR / CCPA 2.1.4
  • Cookie Notice & Compliance for GDPR / CCPA 2.1.5
  • Cookie Notice & Compliance for GDPR / CCPA 2.2.0
  • Cookie Notice & Compliance for GDPR / CCPA 2.2.1
  • Cookie Notice & Compliance for GDPR / CCPA 2.2.2
  • Cookie Notice & Compliance for GDPR / CCPA 2.2.3
  • Cookie Notice & Compliance for GDPR / CCPA 2.3.0
  • Cookie Notice & Compliance for GDPR / CCPA 2.3.1
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.0
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.1
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.2
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.3
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.4
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.5
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.6
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.7
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.8
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.9
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.10
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.11
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.11.1
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.13
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.14
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.15
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.16
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.17
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.17.1
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.18
  • Cookie Notice & Compliance for GDPR / CCPA 2.5.0
  • Cookie Notice & Compliance for GDPR / CCPA 2.5.0.1
  • Cookie Notice & Compliance for GDPR / CCPA 2.5.1
  • Cookie Notice & Compliance for GDPR / CCPA 2.5.2
  • Cookie Notice & Compliance for GDPR / CCPA 2.5.3
  • Cookie Notice & Compliance for GDPR / CCPA 2.5.4
  • Cookie Notice & Compliance for GDPR / CCPA 2.5.5
  • Cookie Notice & Compliance for GDPR / CCPA 2.5.6
  • Cookie Notice & Compliance for GDPR / CCPA 2.5.7
  • Cookie Notice & Compliance for GDPR / CCPA 2.5.8

Authenticated (Admin+) Stored Cross-Site Scripting

Skrevet den af i Cookie Notice & Compliance for GDPR / CCPA

Due to insufficient input sanitization and output escaping, makes it possible for authenticated attackers, with administrative privileges and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected /wp-admin/admin.php?page=cookie-notice page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

This vulnerability affects the following application versions:

  • Cookie Notice & Compliance for GDPR / CCPA 1.4.12
  • Cookie Notice & Compliance for GDPR / CCPA 2.0.0
  • Cookie Notice & Compliance for GDPR / CCPA 2.0.1
  • Cookie Notice & Compliance for GDPR / CCPA 2.0.2
  • Cookie Notice & Compliance for GDPR / CCPA 2.0.3
  • Cookie Notice & Compliance for GDPR / CCPA 2.0.4
  • Cookie Notice & Compliance for GDPR / CCPA 2.1.0
  • Cookie Notice & Compliance for GDPR / CCPA 2.1.1
  • Cookie Notice & Compliance for GDPR / CCPA 2.1.2
  • Cookie Notice & Compliance for GDPR / CCPA 2.1.3
  • Cookie Notice & Compliance for GDPR / CCPA 2.1.4
  • Cookie Notice & Compliance for GDPR / CCPA 2.1.5
  • Cookie Notice & Compliance for GDPR / CCPA 2.2.0
  • Cookie Notice & Compliance for GDPR / CCPA 2.2.1
  • Cookie Notice & Compliance for GDPR / CCPA 2.2.2
  • Cookie Notice & Compliance for GDPR / CCPA 2.2.3
  • Cookie Notice & Compliance for GDPR / CCPA 2.3.0
  • Cookie Notice & Compliance for GDPR / CCPA 2.3.1
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.0
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.1
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.2
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.3
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.4
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.5
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.6
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.7
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.8
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.9
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.10
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.11
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.11.1
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.13
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.14
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.15
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.16
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.17
  • Cookie Notice & Compliance for GDPR / CCPA 2.4.17.1