CVE-2024-8397: Webtoffee Gdpr Cookie Consent

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not properly sanitize and escape the IP headers when logging them, allowing visitors to conduct Stored Cross-Site Scripting attacks. The payload gets triggered when an admin visits the 'Consent report' page and the malicious script is executed in the admin context.

Affected products

• Webtoffee Gdpr Cookie Consent: before 2.61 (fixed in 2.61)

Published 2025-05-15. Last modified 2026-06-17.