CVE-2025-2205
📋 TL;DR
This stored XSS vulnerability in the GDPR Cookie Compliance WordPress plugin allows authenticated administrators to inject malicious scripts into admin settings pages. The injected scripts execute when other users view those pages, potentially compromising their accounts. Only WordPress multisite installations and sites with unfiltered_html disabled are affected.
💻 Affected Systems
- GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice – CCPA, DSGVO, RGPD WordPress plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers with admin access could steal session cookies, redirect users to malicious sites, or perform actions as other administrators, potentially leading to full site compromise.
Likely Case
Malicious administrators could inject tracking scripts, deface admin pages, or perform limited privilege escalation within the WordPress environment.
If Mitigated
With proper access controls and input validation, impact is limited to the specific admin user's actions within their authorized scope.
🎯 Exploit Status
Requires administrator-level WordPress credentials. Exploitation is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.15.7 or later
Vendor Advisory: https://wordpress.org/plugins/gdpr-cookie-compliance/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'GDPR Cookie Compliance' plugin. 4. Click 'Update Now' if available. 5. Alternatively, download version 4.15.7+ from WordPress.org and manually update.
🔧 Temporary Workarounds
Disable plugin
allTemporarily disable the vulnerable plugin until patched
wp plugin deactivate gdpr-cookie-compliance
Enable unfiltered_html
allEnable unfiltered_html capability for administrators (not recommended for security)
Add define('DISALLOW_UNFILTERED_HTML', false); to wp-config.php
🧯 If You Can't Patch
- Restrict administrator account creation and review existing admin users for suspicious activity
- Implement web application firewall rules to block XSS payloads targeting admin endpoints
🔍 How to Verify
Check if Vulnerable:
Check plugin version in WordPress admin → Plugins → Installed Plugins. If version is 4.15.6 or lower and you have multisite or unfiltered_html disabled, you are vulnerable.Check Version:
wp plugin get gdpr-cookie-compliance --field=versionVerify Fix Applied:
Verify plugin version is 4.15.7 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual admin user activity, especially plugin settings modifications
- POST requests to plugin admin endpoints with script tags in parameters
Network Indicators:
- HTTP requests containing script payloads to /wp-admin/admin.php?page=gdpr-cookie-compliance
SIEM Query:
source="wordpress" AND (uri_path="/wp-admin/admin.php" AND uri_query="*page=gdpr-cookie-compliance*" AND (http_method="POST" OR parameters CONTAINS "<script"))