Known vulnerabilities in Cookiebot by Usercentrics – Automatic Cookie Banner for GDPR/CCPA & Google Consent Mode

Install your cookie banner in minutes. Automatically scan and block cookies to comply with the GDPR, CCPA, Google Consent Mode v2. Free plan option.

4Reported vulnerabilities

6.1Highest CVSS score

4.7.2Latest version

100,000+Active installs

What to do now

Update Cookiebot by Usercentrics – Automatic Cookie Banner for GDPR/CCPA & Google Consent Mode to 4.6.5 or later. 4 of these have a fixed version available. Updating resolves them.

Plugin last updated: June 22, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
WF-765df8f4-438c-41b6-ac74-494f1b74cf33	Medium 6.1	—	Before 3.6.1	`3.6.1`	September 8, 2020
CVE-2026-25407	Medium 4.3	0.2%	4.6.4 and earlier	`4.6.5`	January 29, 2026
CVE-2025-53197	Medium 4.3	0.1%	4.5.8 and earlier	`4.5.9`	June 27, 2025
CVE-2025-1666	Medium 4.3	0.3%	0 to 4.4.1 (inclusive)	`4.4.2`	March 6, 2025

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.