Medium · 6.1 CVE-2021-36887 EUVD-2021-23463GHSA-w9q6-vv8m-4f39

WordPress tarteaucitron.js – Cookies legislation & GDPR plugin <= 1.5.4 - Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS)

Published Dec 20, 2021 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: Tarteaucitron Product: tarteaucitron.js – Cookies legislation & GDPR (WordPress plugin) Category: Web / CMS

Description

Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) discovered in tarteaucitron.js – Cookies legislation & GDPR WordPress plugin (versions <= 1.5.4), vulnerable parameters "tarteaucitronEmail" and "tarteaucitronPass".

Affected products

Vendor	Product	Affected	Fixed
Tarteaucitron	tarteaucitron.js – Cookies legislation & GDPR (WordPress plugin)	<= 1.5.4 – ≤ 1.5.4	—

References

https://wordpress.org/plugins/tarteaucitronjs/#developers
https://patchstack.com/database/vulnerability/tarteaucitronjs/wordpress-tarteaucitron-js-cookies-legislation-gdpr-plugin-1-5-4-cross-site-request-forgery-csrf-vulnerability-leading-to-cross-site-scripting-xss