CVE-2019-16522
MEDIUMEU Cookie Law < 3.0.6 - Authenticated Stored Cross-Site Scripting via Configuration Options
Title source: llmDescription
The eu-cookie-law plugin through 3.0.6 for WordPress (aka EU Cookie Law (GDPR)) is susceptible to Stored XSS due to improper encoding of several configuration options in the admin area and the displayed cookie consent message. This affects Font Color, Background Color, and the Disable Cookie text. An attacker with high privileges can attack other users.
References (3)
Core 3
Core References
Product, Third Party Advisory x_refsource_misc
https://wordpress.org/plugins/eu-cookie-law/#developers
Exploit, Third Party Advisory x_refsource_misc
https://github.com/sbaresearch/advisories/tree/public/2019/SBA-ADV-20190913-01_WordPress_Plugin_EU_Cookie_Law
Third Party Advisory x_refsource_misc
https://wpvulndb.com/vulnerabilities/9918
Scores
CVSS v3
4.8
EPSS
0.0103
EPSS Percentile
59.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-79
Status
published
Products (1)
eu_cookie_law_project/eu_cookie_law
< 3.0.6
Published
Oct 16, 2019
Tracked Since
Feb 18, 2026