Almost all the output functions miss the escaping on translated texts, which is a security risk. Just to name a few: https://github.com/dfactoryplugins/cookie-notice/blob/master/cookie-notice.php#L406 https://github.com/dfactoryplugins/cookie-notice/blob/master/cookie-notice.php#L646 https://github.com/dfactoryplugins/cookie-notice/blob/master/cookie-notice.php#L729