tarteaucitron.js versions before 1.37.0 have a regular expression denial of service (ReDoS) vulnerability. This flaw arises from inefficient regular expression handling in the cookie.purge function, which can be exploited by attackers supplying unescaped cookie names or injecting a specially crafted purgeBtn element. Triggering the vulnerability causes catastrophic backtracking in the regex engine, freezing the page when the purge button is clicked. The CVSS score is low (2.3), reflecting the requirement for user interaction and high attack complexity.
tarteaucitron.js versions from 1.20.1 up to but not including 1.37.0 contain a cross-site scripting (XSS) vulnerability. This occurs because the function getElemAttr resolves 'data-' prefixed attributes, but the validation for https-only URLs only checks the unprefixed attribute. An attacker with the ability to insert markup, such as a CMS author, can exploit this by adding a data-url attribute with a javascript: URL alongside a benign URL, leading to script execution in the site's origin via an iframe src.
The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'REQUEST_URI (path segment after /android_json/search/)' parameter in all versions up to, and including, 11.84 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the app's content mode to be configured as 'webview' (i.e., the 'speed' option is not set to '1'), which is a supported and still-shipped mode, though no longer the default.
The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.82 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to exfiltrate password-reset URLs for arbitrary users, including administrators, mirrored into the push queue by the mail-to-push feature, and use those URLs to take over the targeted accounts. This exploit chain requires the plugin's mail-to-push feature (wpmobile_auto_mail=1) to be enabled, as that setting is what causes outbound WordPress password-reset emails — including the reset URL and key — to be mirrored into the push row queue where they become accessible to the attacker.
CVE-2026-22809 is a Regular Expression Denial of Service (ReDoS) vulnerability found in tarteaucitron.js versions prior to 1.29.0. This vulnerability arises from inefficient regular expression handling of the issuu_id parameter, which can be exploited to cause excessive CPU consumption, leading to denial of service. The vulnerability has a medium severity score of 4.4 and requires local access with high privileges to exploit, without user interaction. It impacts the availability of systems using vulnerable versions of tarteaucitron.js, a popular cookie banner compliance tool. The issue is fixed in version 1.
tarteaucitron.js is a compliant and accessible cookie banner. Prior to version 1.22.0, a vulnerability was identified in tarteaucitron.js where document.currentScript was accessed without verifying that it referenced an actual <script> element. If an attacker injected an HTML element, it could clobber the document.currentScript property. This causes the script to resolve incorrectly to an element instead of the <script> tag, leading to unexpected behavior or failure to load the script path correctly. This issue arises because in some browser environments, named DOM elements become properties on the global document object. An attacker with control over the HTML could exploit this to change the CDN domain of tarteaucitron. This issue has been patched in version 1.22.0.
tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js, allowing a user with high privileges (access to the site's source code or a CMS plugin) to enter a URL containing an insecure scheme such as javascript:alert(). Before the fix, URL validation was insufficient, which could allow arbitrary JavaScript execution if a user clicked on a malicious link. An attacker with high privileges could insert a link exploiting an insecure URL scheme, leading to execution of arbitrary JavaScript code, theft of sensitive data through phishing attacks, or modification of the user interface behavior. This vulnerability is fixed in 1.20.1.
The WPMobile.App plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 11.56. This is due to insufficient validation on the redirect URL supplied via the 'redirect' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
The The WPMobile.App — Android and iOS Mobile Application plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 11.52. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.