CVE-2021-24569

PoC —

CVSS 3.1

4.8 medium

EPSS

<1%p48

Published

Sep 27, 2021 (Sep 27, 2021)

Modified

Jun 17, 2026

Description

The Cookie Notice & Compliance for GDPR / CCPA WordPress plugin before 2.1.2 does not escape the value of its Button Text setting when outputting it in an attribute in the frontend, allowing high privilege users such as admin to perform Cross-Site Scripting even when the unfiltered_html capability is disallowed.

Vendors: hu-manity
Products: cookie notice \& compliance for gdpr \/ ccpa
Ecosystems: WordPress
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news0 stories

No ingested article mentions this CVE yet.