{"error":0,"message":null,"data":{"name":"Beautiful Cookie Consent Banner","plugin":"beautiful-and-responsive-cookie-consent","link":"https:\/\/wordpress.org\/plugins\/beautiful-and-responsive-cookie-consent\/","latest":"1764575520","closed":0,"closed_reason":null,"closed_date":null,"vulnerability":[{"uuid":"104b858a0d667b3022b5ebca79ce4b9b67f48f5c0ba7c2a1ad159cc78ed4d74c","name":"Beautiful Cookie Consent Banner [beautiful-and-responsive-cookie-consent] < 2.9.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.9.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2022-3823","name":"CVE-2022-3823","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2022-3823","description":"[en] The Beautiful Cookie Consent Banner WordPress plugin before 2.9.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).","date":"2022-11-28"},{"id":"5268282f07e8944edd8a3455332c5256886de123","name":"WordPress Beautiful Cookie Consent Banner plugin <= 2.9.0 - Auth. Stored Cross-Site Scripting (XSS) vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/beautiful-and-responsive-cookie-consent\/vulnerability\/wordpress-beautiful-cookie-consent-banner-plugin-2-9-0-auth-stored-cross-site-scripting-xss-vulnerability","description":"Auth. Stored Cross-Site Scripting (XSS) vulnerability discovered by zhangyunpei in the WordPress Beautiful Cookie Consent Banner plugin (versions <= 2.9.0).\nUpdate the WordPress Beautiful Cookie Consent Banner plugin to the latest available version (at least 2.9.1).","date":"2022-11-03"},{"id":"97710a757e70323f4e40282c17fcf691a03686cf","name":"Beautiful Cookie Consent Banner <= 2.9.0 - Authenticated (Admin+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/beautiful-and-responsive-cookie-consent\/beautiful-cookie-consent-banner-290-authenticated-admin-stored-cross-site-scripting","description":"The Beautiful Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 2.9.0 due to insufficient input sanitization and output escaping. This makes it possible for administrator-level attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2022-11-03"},{"id":"a072b091-5e5f-4e88-bd3d-2f4582e6564e","name":"Beautiful Cookie Consent Banner &lt; 2.9.1 - Admin+ Stored XSS","link":"https:\/\/wpscan.com\/vulnerability\/a072b091-5e5f-4e88-bd3d-2f4582e6564e","description":"The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).","date":null}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"h","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"4.8","severity":"m","exploitable":"1.7","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"4.8","severity":"medium","av":"network","ac":"low","pr":"high","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"1.7","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"a505b575052c7d9648c3c7c93dce56017a67b46cdcdba484de682afb9d5cea92","name":"Beautiful Cookie Consent Banner [beautiful-and-responsive-cookie-consent] < 2.10.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.10.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"d2a445136d1a6be962e15c0f78eb6c325db3e7c4","name":"Beautiful Cookie Consent Banner <= 2.10.0 - Missing Authorization to Settings Update","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/beautiful-and-responsive-cookie-consent\/beautiful-cookie-consent-banner-2100-missing-authorization-to-settings-update","description":"The Beautiful Cookie Consent Banner plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the nsc_bar_save_submitted_form_fields() function called via and admin_init hook in versions up to, and including, 2.10.0. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious web scripts. Please note this is still vulnerable to Cross-Site Request Forgery attacks.","date":"2023-01-31"}],"impact":[]},{"uuid":"15f177b87cffb63bf4b298829254d502a70735045847808d1bda87ec24a7349c","name":"Beautiful Cookie Consent Banner [beautiful-and-responsive-cookie-consent] < 2.10.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.10.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"2dd3fb0b905f60f848fe32e6ae8b96677a4c964a","name":"Beautiful Cookie Consent Banner <= 2.10.1 - Unauthenticated Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/beautiful-and-responsive-cookie-consent\/beautiful-cookie-consent-banner-2100-unauthenticated-stored-cross-site-scripting","description":"The Beautiful Cookie Consent Banner for WordPress is vulnerable to Stored Cross-Site Scripting via the 'nsc_bar_content_href' parameter in versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A partial patch was made available in 2.10.1 and the issue was fully patched in 2.10.2.","date":"2023-01-31"},{"id":"CVE-2023-3388","name":"CVE-2023-3388","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-3388","description":"[en] The Beautiful Cookie Consent Banner for WordPress is vulnerable to Stored Cross-Site Scripting via the 'nsc_bar_content_href' parameter in versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A partial patch was made available in 2.10.1 and the issue was fully patched in 2.10.2.","date":"2023-06-24"},{"id":"ff83570c-cbd5-4d04-9c4f-28c70dc2b854","name":"Beautiful Cookie Consent Banner &lt; 2.10.2 - Unauthenticated Stored Cross-Site Scripting","link":"https:\/\/wpscan.com\/vulnerability\/ff83570c-cbd5-4d04-9c4f-28c70dc2b854","description":"The plugin is affected by an Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability due to a lack of input sanitization and output escaping.","date":null}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"6.1","severity":"m","exploitable":"2.8","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"6.1","severity":"medium","av":"network","ac":"low","pr":"none","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"2.8","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"6ec84250421475322eef6bb572bad8f9defa08020e1e7de7dba0fa1f2c2c7222","name":"Beautiful Cookie Consent Banner [beautiful-and-responsive-cookie-consent] < 2.10.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.10.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"e99fa9cb79fc441194ec19a15f00869325c92581","name":"WordPress  Beautiful Cookie Consent Banner Plugin  <= 2.10.0 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/beautiful-and-responsive-cookie-consent\/vulnerability\/wordpress-beautiful-cookie-consent-banner-plugin-2-10-0-unauthenticated-stored-cross-site-scripting-vulnerability","description":"Update the WordPress Beautiful Cookie Consent Banner plugin to the latest available version (at least 2.10.1).\nWordfence discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Beautiful Cookie Consent Banner Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site.  This vulnerability has been fixed in version 2.10.1.","date":"2023-02-01"}],"impact":[]},{"uuid":"e9d887847ee852851e062520748d3383dcb55f19ca73a676b958355910368dcf","name":"Beautiful Cookie Consent Banner [beautiful-and-responsive-cookie-consent] < 2.10.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.10.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"a1702da43b05fc3064a613bf7473ed83c05d29b2","name":"WordPress  Beautiful Cookie Consent Banner Plugin  <= 2.10.0 is vulnerable to Broken Access Control","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/beautiful-and-responsive-cookie-consent\/vulnerability\/wordpress-beautiful-cookie-consent-banner-plugin-2-10-0-missing-authorization-to-settings-update-vulnerability","description":"Update the WordPress Beautiful Cookie Consent Banner plugin to the latest available version (at least 2.10.1).\nWordfence discovered and reported this Broken Access Control vulnerability in WordPress Beautiful Cookie Consent Banner Plugin.  This vulnerability has been fixed in version 2.10.1.","date":"2023-02-01"}],"impact":[]},{"uuid":"3f87263dd009f558762b3f8c98839e3746ddd4a1b86c4c3afcdd5a0d2bfb9e8a","name":"Beautiful Cookie Consent Banner [beautiful-and-responsive-cookie-consent] < 2.10.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.10.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"438c6818-cace-410b-ace3-325e5ea06365","name":"Beautiful Cookie Consent Banner &lt; 2.10.2 - Unauthenticated Stored XSS","link":"https:\/\/wpscan.com\/vulnerability\/438c6818-cace-410b-ace3-325e5ea06365","description":"The plugin does not have authorisation and CSRF check when updating its settings, and does not escape some of them when outputting them, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks. An initial fix was released in version 2.10.1, and completed in 2.10.2.\r\n\r\nNote: The issue is being actively exploited","date":null}],"impact":[]},{"uuid":"b5d9ab943b0097108b6acde09de62c2a9cbf29c0735d1975abe562ed817b373c","name":"Beautiful Cookie Consent Banner [beautiful-and-responsive-cookie-consent] < 4.6.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.6.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2025-49866","name":"CVE-2025-49866","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-49866","description":"[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nikel Beautiful Cookie Consent Banner beautiful-and-responsive-cookie-consent allows Reflected XSS.This issue affects Beautiful Cookie Consent Banner: from n\/a through <= 4.6.1.","date":"2025-07-04"},{"id":"c43283966a74735763a06f4d8a805133c639681e","name":"WordPress Beautiful Cookie Consent Banner Plugin <= 4.6.1 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/beautiful-and-responsive-cookie-consent\/vulnerability\/wordpress-beautiful-cookie-consent-banner-4-6-1-cross-site-scripting-xss-vulnerability","description":"<p>WordPress Beautiful Cookie Consent Banner Plugin <= 4.6.1 is vulnerable to Cross Site Scripting (XSS)<\/p><p>Software: Beautiful Cookie Consent Banner<\/p><p>Fixed in version 4.6.2 <\/p><p>Affected Version <= 4.6.1<\/p><p>CVE: CVE-2025-49866<\/p>","date":"2025-07-01"},{"id":"5e3cadbf87a874717428fb1fca493687f452fbe0","name":"Beautiful Cookie Consent Banner <= 4.6.1 - Reflected Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/beautiful-and-responsive-cookie-consent\/beautiful-cookie-consent-banner-461-reflected-cross-site-scripting","description":"The Beautiful Cookie Consent Banner plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 4.6.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.","date":"2025-07-01"},{"id":"EUVD-2025-19989","name":"EUVD-2025-19989","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2025-19989","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nikel Beautiful Cookie Consent Banner allows Reflected XSS. This issue affects Beautiful Cookie Consent Banner: from n\/a through 4.6.1.","date":"2025-07-04"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:L","av":"n","ac":"l","pr":"n","ui":"r","s":"c","c":"l","i":"l","a":"l","score":"7.1","severity":"h","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:L","score":"7.1","severity":"high","av":"network","ac":"low","pr":"none","ui":"required","s":"changed","c":"low","i":"low","a":"low","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}}]},"updated":"1776153795"}