The GDPR Cookie Compliance plugin is a widely used tool for WordPress sites, enabling them to display cookie consent banners and helping website owners comply with the European Union’s General Data Protection Regulation (GDPR). However, a serious vulnerability (CVE-2025-1623) has been discovered that allows attackers to inject malicious JavaScript code into the “Tracking ID” field under the plugin’s integrations settings. This vulnerability can lead to the execution of stored XSS (Cross-Site Scripting) scripts, allowing for the creation of a backdoor account and other malicious activities. With over 300,000 active installations, this vulnerability poses a significant security risk to websites using this plugin.
CVE-2025-1623 – GDPR Cookie Compliance – Stored XSS to JS Backdoor Creation – POC
