CVE-2026-14816

MediumCVSS 6.5/10Last modified Aug 26, 2026

Description

The GDPR Framework By Data443 WordPress plugin before 2.4.0 does not properly verify authorization or the identity of the data subject when recording cookie-consent choices and privacy requests, allowing unauthenticated attackers to forge consent records for arbitrary email addresses and to flood the site's privacy-request queue with arbitrary entries.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published
Aug 4, 2026
Last modified
Aug 26, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-148176.8The Element Pack Addons for Elementor WordPress plugin before 8.7.13 does not sanitize option values passed through certain data attributesCVE-2026-148187.2A path traversal vulnerability in the CLI command used to execute configuration files in Zyxel ATP series firmware versions from V4.32 throuCVE-2026-148193.5The Event Tickets and Registration WordPress plugin before 5.28.4 does not properly escape event titles before outputting them in a ticket hCVE-2026-14827.5An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by GabinetCVE-2026-148205.3The Quiz and Survey Master (QSM) WordPress plugin before 11.1.3 does not implement rate limiting or standard failed-login auditing on its fCVE-2026-148212.7The Quiz and Survey Master (QSM) WordPress plugin before 11.1.5 does not perform a capability check before deleting output templates, allowCVE-2026-148225.3The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not perform any authorization check on one of its order-management CVE-2026-148232.2The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not properly verify authorization on some of its seating actions, aCVE-2026-148244.8The Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unCVE-2026-148252.7The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check before saving a quiz's front-CVE-2026-148262.7The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that returCVE-2026-148276.8The Calendar WordPress plugin before 1.3.18 does not properly escape a user-supplied event field before outputting it inside an HTML attribu
CVE-2026-14816: Medium severity, CVSS 6.5 | Vulnix