EUVD-2026-74775
GHSA-79fj-972f-xc72
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Nonce is publicly emitted eliminating all auth barriers (PR:N, AC:L); stored XSS executes across browser scope change (S:C); no server-side CIA directly impacted beyond stored malicious data.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Cookie Banner for GDPR / CCPA - WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpl_user_preference' parameter in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The consent-logging AJAX endpoint is registered for unauthenticated users and its required nonce (wpl_consent_logging_nonce) is publicly emitted via wp_localize_script on the frontend, meaning any unauthenticated site visitor can plant a payload without any prior authentication or privileged access.
Articles & Coverage 1
AnalysisAI
Stored cross-site scripting in the WPLP Cookie Consent WordPress plugin (all versions ≤ 4.4.1) enables any unauthenticated site visitor to inject persistent malicious scripts via the wpl_user_preference AJAX parameter. The consent-logging endpoint is registered without authentication requirements, and the protective nonce (wpl_consent_logging_nonce) is publicly broadcast to every page visitor via wp_localize_script(), rendering the nonce mechanism entirely ineffective as an access barrier. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The WPLP Cookie Consent plugin (version ≤ 4.4.1) must be installed and active on the WordPress site, with the consent-logging AJAX action registered and reachable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N = 7.2) accurately models this flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the WPLP Cookie Consent plugin to the version that incorporates fix commit changeset 3674117 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3674117%40gdpr-cookie-consent&new=3674117%40gdpr-cookie-consent); the exact patched release version number is not confirmed in the available input data - verify the current version in the WordPress plugin directory before updating, and confirm the installed version exceeds 4.4.1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, verify whether your WordPress installation uses WPLP Cookie Consent and identify the installed version; simultaneously audit recent access logs and database records for suspicious submissions to the wpl_user_preference parameter. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wplegalpages
View allUnauthenticated arbitrary file upload in the WPLP Cookie Consent (GDPR/CCPA cookie banner) plugin for WordPress, version
Unauthenticated broken authentication in the WPLegalPages WordPress plugin (versions ≤ 3.7.0) allows remote attackers to
Stored XSS in the WPLP Cookie Consent WordPress plugin (all versions through 4.3.5) enables attackers to inject persiste
The WPLegalPages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wplegalpage' shortcode in versio
SQL injection in the Cookie Banner for GDPR/CCPA - WPLP Cookie Consent WordPress plugin (all versions up to and includin
SQL Injection in the Cookie Banner for GDPR/CCPA - WPLP Cookie Consent WordPress plugin (versions up to and including 4.
Unauthorized modification of cookie scan schedule configuration in the GDPR Cookie Consent WordPress plugin (versions up
Unauthenticated cross-site request forgery in the WPLP Cookie Consent WordPress plugin up to version 4.3.7 allows attack
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today