WP Cookie Notice CVE-2026-42636

Exploitation requires that a WordPress site run the WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin at version 4.4.6 or earlier, and that an attacker get a victim (site visitor or logged-in administrator) to interact with attacker-controlled input - per CVSS UI:R, typically by clicking a crafted link or submitting a poisoned request that the plugin renders without sanitization. The principal limiting factor is this mandatory user interaction: no victim action means no code execution. No special plugin configuration is cited as a prerequisite, and the attacker needs no authentication (PR:N).

This is a moderate-severity, moderate-priority issue rather than an emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) describes a network-reachable, low-complexity, unauthenticated flaw, but the UI:R requirement means a victim must be tricked into interacting (e.g. clicking a crafted link or visiting a malicious page), which materially lowers real-world exploitability compared to a no-interaction flaw. The scope change (S:C) and the low C/I/A impacts are consistent with a classic Cross-Site Scripting bug (CWE-79) where script executes in the victim's browser session rather than compromising the server directly. No EPSS score, no CISA KEV listing, and no public exploit (POC) are present in the supplied data, so exploitation status is 'no public exploit identified at time of analysis'; the absence of these signals, combined with the UI:R requirement, points to opportunistic/phishing-style abuse rather than mass automated exploitation. No signals conflict here - the CVSS vector, description ('Unauthenticated XSS'), and CWE all agree. The main uncertainty is whether the XSS is reflected or stored, which the single-sentence description and lone Patchstack reference do not clarify.

An attacker crafts a malicious link or request carrying JavaScript that the vulnerable WP Cookie Notice plugin (<= 4.4.6) reflects or renders without proper sanitization, then lures a site visitor or administrator into triggering it. When the victim's browser processes the page, the injected script runs in the site's context, enabling session/cookie theft, defacement, or forced admin actions. No public exploit code was identified in the provided data, and successful attack requires the victim's interaction (UI:R).