VULNERABILITY INTELLIGENCE

CVE-2021-36887

CVSS score6.1 MEDIUM

EPSS probability0.51%

CISA KEVNot currently listed

Published2021-12-20

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L

Description

Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) discovered in tarteaucitron.js – Cookies legislation & GDPR WordPress plugin (versions <= 1.5.4), vulnerable parameters "tarteaucitronEmail" and "tarteaucitronPass".

Weakness classification

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-352: Cross-Site Request Forgery (CSRF)

Primary references

audit@patchstack.com — Exploit, Third Party Advisory
audit@patchstack.com — Release Notes, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Third Party Advisory