Plugins · wp-gdpr-compliance · data as of 2026-11-01
Is Cookie Information safe? Known vulnerabilities and latest version
- Status
- Closed 2024-02-23
- Known issues on record
- 4
- Unpatched in latest
- 0
What to do
- Replace it. A closed plugin gets no updates through WordPress, so any hole found from now on stays open.
- Deactivate and delete it once you have a replacement (Plugins → Deactivate → Delete). Deleting removes its files; deactivating alone leaves them on the server.
- If you ran a vulnerable version and something looks off (spam pages, strange admins, redirects), run the free scan, or have us clean it: Emergency Cleanup, $499.
With WP-CLI, once you have a replacement: wp plugin deactivate wp-gdpr-compliance && wp plugin delete wp-gdpr-compliance
Check your version
Known vulnerabilities
4 on record, newest first. “Affected” is the version range the source gives; “fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. 4 record(s) do not state which versions are affected.
medium 5.4 CVE-2024-33682 · published 2024-04-26
Cross-site request forgery (CSRF) in Cookie Information (2.0.23 and older)
- Affected
- 2.0.23 and older
- Fixed in
- unknown
- Access needed (per CVSS)
- No login needed; someone on the site has to click a link or open a page
- Range from
- CVE record (the advisory publisher) · score by Patchstack
Details from the advisory
Cross-Site Request Forgery (CSRF) vulnerability in Cookie Information A/S WP GDPR Compliance.This issue affects WP GDPR Compliance: from n/a through 2.0.23.
high 8.8 CVE-2023-6700 · published 2024-02-05
Missing authorization check in Cookie Information (2.0.22 and older)
- Affected
- 2.0.22 and older
- Fixed in
- unknown
- Access needed (per CVSS)
- Needs a low-level account (e.g. subscriber)
- Range from
- CVE record (the advisory publisher) · score by NVD
Details from the advisory
The Cookie Information | Free GDPR Consent Solution plugin for WordPress is vulnerable to arbitrary option updates due to a missing capability check on its AJAX request handler in versions up to, and including, 2.0.22. This makes it possible for authenticated attackers, with subscriber-level access or higher, to edit arbitrary site options which can be used to create administrator accounts.
medium 6.1 CVE-2022-0147 · published 2022-03-14
Reflected cross-site scripting (XSS) in Cookie Information (older than 2.0.8)
- Affected
- older than 2.0.8
- Fixed in
- 2.0.8
- Access needed (per CVSS)
- No login needed; someone on the site has to click a link or open a page
- Range from
- NVD analysis · score by NVD
Details from the advisory
The Cookie Information | Free GDPR Consent Solution WordPress plugin before 2.0.8 does not escape user data before outputting it back in attributes in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
critical 9.8 CVE-2018-19207 · published 2018-11-12
Remote code execution in Cookie Information (older than 1.4.3)
- Affected
- older than 1.4.3
- Fixed in
- 1.4.3
- Access needed (per CVSS)
- No login needed
- Range from
- NVD analysis · score by NVD
Details from the advisory
The Van Ons WP GDPR Compliance (aka wp-gdpr-compliance) plugin before 1.4.3 for WordPress allows remote attackers to execute arbitrary code because $wpdb->prepare() input is mishandled, as exploited in the wild in November 2018.
NVD CVE-2018-19207wordpress.orgsecurityfocus.comwpvulndb.comWordfence advisory
Recent activity
- 2024-02-23 — closed on wordpress.org (Author Request).
- 2024-04-26 — Cross-site request forgery (CSRF) disclosed (CVE-2024-33682), fix version not stated.
- 2024-02-05 — Missing authorization check disclosed (CVE-2023-6700), fix version not stated.
- 2022-03-14 — Reflected cross-site scripting (XSS) disclosed (CVE-2022-0147), fixed in 2.0.8.
Get an email when Cookie Information has a new vulnerability
Free. We check the CVE feeds every day and email you only when a new issue for Cookie Information (wp-gdpr-compliance) is published or a fix ships. Unsubscribe in one click.
Where this data comes from
- Version, last update, installs, closure: wordpress.org/plugins/wp-gdpr-compliance (Plugins API), fetched 2026-11-01.
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-01. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Each record links to its CVE page and to the original advisory (Wordfence, Patchstack or WPScan) where there is one. We only list a CVE here when its references or its advisory name this exact plugin, so a few real issues may be missing; none should be about a different plugin. Spot an error? Email Daniel.
Badge for your site or docs (states facts with a date, not a verdict):
<a href="https://laskyr.com/plugins/wp-gdpr-compliance"><img src="https://laskyr.com/plugins/wp-gdpr-compliance/badge.svg" alt="Cookie Information vulnerability status"></a>