CVE-2025-2205 GDPR Cookie Compliance <= 4.15.6 - Authenticated (Admin+) Stored Cross-Site Scripting

Q: What is CVE-2025-2205?

CVE-2025-2205 is a medium-severity cross-site scripting vulnerability in mooveagency GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice for CCPA, EU Cookie Law, published on 12 Mar 2025. An attacker needs administrator access to exploit it, with no action from the victim.

Q: Is CVE-2025-2205 being exploited?

There is no known exploitation of CVE-2025-2205 in the wild and no public exploit code.

Q: How do I fix CVE-2025-2205?

No fix has been published for CVE-2025-2205 yet. Limit exposure of the affected software until one is available.

Medium 4.4 Published 12 Mar 2025 Updated 8 Apr 2026

Administrators can inject arbitrary scripts into WordPress admin settings, affecting multi-site or restricted HTML installations.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-2205?

CVE-2025-2205 is a medium-severity cross-site scripting vulnerability in mooveagency GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice for CCPA, EU Cookie Law, published on 12 Mar 2025. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

The GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice – CCPA, DSGVO, RGPD plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.15.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Weakness: CWE-79

Which versions are affected by CVE-2025-2205?

It affects 1 product.

Products include Mooveagency Gdpr Cookie Compliance.

How do I fix CVE-2025-2205?

No fix has been published for CVE-2025-2205 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2025-2205 being exploited?

There is no known exploitation of CVE-2025-2205 in the wild and no public exploit code.

Sources

Also known as GHSA-vmg5-6fp3-rr56.