The GDPR Cookie Compliance plugin for WordPress is widely used to help websites comply with the European Union’s General Data Protection Regulation (GDPR). One of the core features of the plugin is its cookie consent banner, which informs users about the use of cookies and requests their consent. However, a critical vulnerability, CVE-2025-1622, has been identified in the plugin. This Stored Cross-Site Scripting (XSS) vulnerability allows an attacker with editor-level access to inject malicious JavaScript into the “Cookie Banner Content” field. Once saved, the injected script is stored and executed when the banner is displayed on the site’s frontend, potentially leading to account takeover and the creation of backdoor admin accounts. With over 300,000 active installations, this vulnerability poses a significant security risk for WordPress websites using the GDPR Cookie Compliance plugin.
CVE-2025-1622 – GDPR Cookie Compliance – Stored XSS to JS Backdoor Creation – POC
