Exploit for Cookie Notice & Consent Banner for GDPR & CCPA Compliance < 1.7.2 - Authenticated Stored XSS

CVE-2021-24590

wpexploit · 2021-08-06

Description

Cookie Notice & Consent Banner for GDPR & CCPA Compliance < 1.7.2 - Authenticated Stored XSS. Inject XSS payload in "Info Text" field on Customize Design page

Affected Gdprinfo Cookie Notice \& Consent Banner For Gdpr \& Ccpa Compliance versions

Gdprinfo Cookie Notice \& Consent Banner For Gdpr \& Ccpa Compliance< 1.7.2

All known vulnerabilities by product

Cookie Notice & Consent Banner For Gdpr & Ccpa Compliance

CVSS 5.4 for CVE-2021-24590

5.4

MEDIUM SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:LOW

User Interaction:REQUIRED

Scope:CHANGED

Confidentiality:LOW

Integrity:LOW

Availability:NONE

EPSS Score

0.6%higher than 45.4% of all CVEs

Updated 2026-07-01

Exploit Details

Modified:2021-08-06 20:11

Last Seen:2021-11-26 19:32

Reporter:Asif Nawaz Minhas

Exploit Code

MARKDOWN2 lines

## https://sploitus.com/exploit?id=WPEX-ID:D6846774-1958-4C8D-BB64-AF0D8C46E6E7
Go to the plugin's Customize Design page and open the "Wizard menu". Now scroll down and you will find an "Info Text" field where you can inject an XSS payload like "<details open ontoggle=confirm()>". Click "Publish" to store the payload.

Exploit Code

Share

Share on social media: