CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in SpruceJoy Cookie Consent & Autoblock for GDPR/CCPA cookie-consent-autoblock allows Stored XSS.This issue affects Cookie Consent & Autoblock for GDPR/CCPA: from n/a through <= 1.0.1.
Explanation of Vulnerability in Simple Terms
SpruceJoy's Cookie Consent & Autoblock plugin for GDPR/CCPA contains a cross-site request forgery (CSRF) vulnerability in versions up to 1.0.1. An attacker can trick a site administrator into performing unintended actions—such as changing consent settings or disabling cookie blocking—by crafting a malicious link or page. The vulnerability requires the admin to visit the attacker's page while logged into WordPress. Site owners should update immediately when a patch becomes available.
What an attacker can do
Trick an admin into changing cookie consent settings or disabling the plugin's blocking features without their knowledge.
Potential impact on your site
Cookie consent and GDPR/CCPA compliance settings could be altered or disabled without your authorization.
Conditions required to exploit
Admin must be logged into WordPress and visit a page controlled by the attacker (e.g., click a malicious link).
Key dates
External resources
Related vulnerabilities
