EUVD-2026-58863
GHSA-wj5r-wjwf-mg3q
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Full exploit chain requires Subscriber authentication (PR:L) and non-default GCM configuration (AC:H); stored XSS fires when a victim visits an injected page (UI:R); scope changes as payload executes in victim browsers.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Cookie Banner for GDPR / CCPA - WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regionArray' parameter in all versions up to, and including, 4.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires that the site administrator has enabled the 'Support Google Consent Mode (GCM)' setting, which is disabled by default. Additionally, the AJAX handler performs no nonce or capability check, allowing any authenticated user including those with Subscriber-level access to overwrite the affected plugin setting.
AnalysisAI
Stored XSS in the WPLP Cookie Consent WordPress plugin (all versions through 4.3.5) enables attackers to inject persistent JavaScript payloads via the unsanitized 'regionArray' parameter, executing in any visitor's browser on affected pages. The attack surface is compounded by a secondary flaw: the plugin's AJAX handler for Google Consent Mode (GCM) configuration performs no nonce verification and no capability check, permitting even Subscriber-level authenticated users to programmatically enable the GCM feature - the prerequisite for the XSS injection vector. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Full exploitation requires both of the following conditions to be satisfied simultaneously: first, the attacker must hold a WordPress user account at Subscriber level or higher on the target site - obtainable via open registration, a compromised existing account, or any lower-privilege role assignment; second, the 'Support Google Consent Mode (GCM)' plugin setting must be active during the injection phase - however, because the AJAX handler that controls this setting performs no nonce check and no capability check, the attacker's own Subscriber account is sufficient to enable it without administrator involvement, meaning the non-default status of the setting does not function as a reliable mitigating barrier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:C scores 7.2 and reflects a theoretical worst case where GCM is already admin-enabled and any network actor can inject the payload; however, the description reveals that the full exploit chain is actually gated on at minimum Subscriber-level authentication, since that role is sufficient to enable GCM via the unchecked AJAX handler - a meaningful real-world constraint the PR:N assignment does not capture. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the WPLP Cookie Consent plugin to version 4.4.0 or later; a code change in the admin handler is referenced by WordPress plugin changeset 3641387 at https://plugins.trac.wordpress.org/changeset/3641387/gdpr-cookie-consent/tags/4.4.0/admin/class-gdpr-cookie-consent-admin.php, which represents the upstream fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Audit all WordPress instances for WPLP Cookie Consent plugin versions 4.3.5 or earlier within 24 hours and disable the plugin on affected sites if a patched version is not available. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wplp Cookie Consent Cookie Banner Consent Management For Gdpr Ccpa Google Consent Mode
View allUnauthenticated arbitrary file upload in the WPLP Cookie Consent (GDPR/CCPA cookie banner) plugin for WordPress, version
Unauthenticated cross-site request forgery in the WPLP Cookie Consent WordPress plugin up to version 4.3.7 allows attack
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today