← back to popular plugins
wordfence / plugin · real-cookie-banner
Real Cookie Banner: GDPR & ePrivacy Cookie Consent
real-cookie-banner
total installs
100,000
total vulns
2
critical
0
high
0
medium
2
low
0
latest vuln
—
patched
2
unpatched
0
avg time to patch
—
vulnerabilities
(2)
Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.2.4 - Authenticated (Admin+) Server-Side Request Forgery via scan-without-login Endpoint
medium
✓ patched
cve id
CVE-2025-12136 ↗
cvss score
6.8
cwe
CWE-918: Server-Side Request Forgery (SSRF)
published
Oct 23, 2025
The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.2.4. This is due to insufficient validation on the user-supplied URL in the '/scanner/scan-without-login' REST API endpoint. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services via the `url` parameter.
Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.1.5 - Authenticated (Admin+) Stored Cross-Site Scripting
medium
✓ patched
cve id
CVE-2025-1485 ↗
cvss score
4.4
cwe
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published
May 12, 2025
The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.