Now officially on WordPress.org

CVE Database / CVE-2025-67554

CVE · Medium

CVE-2025-67554 — Cookie Compliance for WordPress – Cookie Consent, GDPR & CCPA [cookie-notice] < 2.5.9

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2025-67554 Cookie Compliance for WordPress – Cookie Consent, GDPR & CCPA [cookie-notice] < 2.5.9 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Medium 5.9 < 2.5.9 2.5.9 2025-10-21 —

CVE-2025-67554

The Cookie Notice & Compliance plugin for WordPress contains a security flaw affecting versions 2.5.8 and below. The issue arises from inadequate filtering of input data, allowing malicious scripts to be embedded within the affected website's content. As a result, authorized attackers can inject arbitrary code that will run whenever users access the compromised pages.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings