CVE-2019-16522

The eu-cookie-law plugin through 3.0.6 for WordPress (aka EU Cookie Law (GDPR)) is susceptible to Stored XSS due to improper encoding of several configuration options in the admin area and the displayed cookie consent message. This affects Font Color, Background Color, and the Disable Cookie text. An attacker with high privileges can attack other users.

• CWE-79

• https://github.com/sbaresearch/advisories/tree/public/2019/SBA-ADV-20190913-01_WordPress_Plugin_EU_Cookie_LawExploit, Third Party Advisory
• https://wordpress.org/plugins/eu-cookie-law/#developersProduct, Third Party Advisory
• https://wpvulndb.com/vulnerabilities/9918Third Party Advisory
• https://github.com/sbaresearch/advisories/tree/public/2019/SBA-ADV-20190913-01_WordPress_Plugin_EU_Cookie_LawExploit, Third Party Advisory
• https://wordpress.org/plugins/eu-cookie-law/#developersProduct, Third Party Advisory
• https://wpvulndb.com/vulnerabilities/9918Third Party Advisory

Published

Oct 16, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-16517An issue was discovered in ConnectWise Control (formerly kno…9.8
• CVE-2019-16518An issue was discovered on Swell Kit Mod devices that use th…4.3
• CVE-2019-16519ESET Cyber Security 6.7.900.0 for macOS allows a local attac…7.8
• CVE-2019-1652A vulnerability in the web-based management interface of Cis…7.2
• CVE-2019-16520The all-in-one-seo-pack plugin before 3.2.7 for WordPress (a…5.4
• CVE-2019-16521The broken-link-checker plugin through 1.11.8 for WordPress …6.1
• CVE-2019-16523The events-manager plugin through 5.9.5 for WordPress (aka E…5.4
• CVE-2019-16524The easy-fancybox plugin before 1.8.18 for WordPress (aka Ea…4.8
• CVE-2019-16525An XSS issue was discovered in the checklist plugin before 1…6.1
• CVE-2019-16528An issue was discovered in the AbuseFilter extension for Med…7.5
• CVE-2019-16529An issue was discovered in the CheckUser extension through 1…5.3
• CVE-2019-1653A vulnerability in the web-based management interface of Cis…7.5