CVE-2026-82186

MediumPublished

WPLP Cookie Consent < 4.4.2 - Admin+ SQLi via 'offset' Parameter

Published: Sep 4, 2026
Updated: Sep 4, 2026
Assigning CNA: WPScan

Primary CVSS

4.1/ 10Medium

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

EPSS probability estimate

0.7%

Low · next 30 days

Percentile: 52.7%
Model date: Oct 31, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks.

Sources

Repository evidence: Files: 1 · Repositories: 1

1 Template

WordPress WPLP Cookie Consent < 4.4.2 - SQL InjectionTemplate
http/cves/2026/CVE-2026-82186.yaml
Nuclei Templates
DetectionEvidence observed: Oct 21, 2026Revision: 0a49c85705b2Related tool
Declared conditions
- network: http($.protocol_keys)
- verification: dsl($.matchers[*].type)

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.