Unknown Wplp Cookie Consent vulnerabilities

7 CVEs affecting Unknown Wplp Cookie Consent, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-85130, published 2026-09-17.

More from Unknown.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-85130, published 2026-09-17. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. The WPLP Cookie Consent WordPress plugin before 4.4.4 does not escape a value submitted through a public endpoint for the JavaScript context it is later output in on an administrative screen,…
• CVE-2026-82186, published 2026-09-04. Medium severity, CVSS 4.1. EPSS: 0.3% chance of exploitation in the next 30 days. The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL…
• CVE-2026-85132, published 2026-09-09. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on one of its cookie scanner AJAX actions, allowing any authenticated user, such as a subscriber, to…
• CVE-2026-82185, published 2026-09-09. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have capability or nonce checks on some of its A/B testing actions, allowing any authenticated user, such as a subscriber, to overwrite…
• CVE-2026-85133, published 2026-09-09. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on several of its settings AJAX actions, allowing any authenticated user, such as a subscriber, to…
• CVE-2026-85131, published 2026-09-16. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. The WPLP Cookie Consent WordPress plugin before 4.4.4 does not perform CSRF or capability checks when processing bulk actions on its administration screens, and does not restrict the targeted items…
• CVE-2026-82184, published 2026-09-09. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have any authorisation or CSRF checks when storing visitor consent state, and the code that does so runs on every front-end page load,…