Low · 3.4 CVE-2021-36889 EUVD-2021-23465GHSA-h2mr-r867-cxv6

WordPress tarteaucitron.js – Cookies legislation & GDPR plugin <= 1.6 - Multiple Stored Authenticated Cross-Site Scripting (XSS) vulnerabilities

Published Dec 20, 2021 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: Tarteaucitron Product: tarteaucitron.js – Cookies legislation & GDPR (WordPress plugin) Category: Web / CMS

Description

Multiple Stored Authenticated Cross-Site Scripting (XSS) vulnerabilities were discovered in tarteaucitron.js – Cookies legislation & GDPR WordPress plugin (versions <= 1.6).

Affected products

Vendor	Product	Affected	Fixed
Tarteaucitron	tarteaucitron.js – Cookies legislation & GDPR (WordPress plugin)	<= 1.6 – ≤ 1.6	—

References

https://wordpress.org/plugins/tarteaucitronjs/#developers
https://patchstack.com/database/vulnerability/tarteaucitronjs/wordpress-tarteaucitron-js-cookies-legislation-gdpr-plugin-1-6-multiple-stored-authenticated-cross-site-scripting-xss-vulnerabilities