WP Cookie Notice CVE-2026-73359

Exploitation requires an authenticated WordPress session with at least subscriber-level privileges, as confirmed by PR:L in the CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C vector. A victim with higher privileges - typically an administrator - must actively load the page or view containing the injected payload (UI:R), making this a stored XSS scenario rather than a self-triggering one. The attack is constrained to WordPress sites running the WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin at version 4.3.9 or earlier. On sites with open user registration, any external actor can obtain a subscriber account, making the effective authentication barrier low. On sites where registration is disabled or restricted, an attacker must already possess or compromise a valid low-privilege credential. No specific non-default plugin configuration is indicated as required by the available data - the vulnerability appears to exist in the default installed state of the affected plugin versions.

The CVSS 3.1 score of 6.5 Medium reflects a balanced but meaningful risk profile. The primary risk amplifier is S:C (scope changed), which signals that successful exploitation crosses trust boundaries - XSS executing in an administrator's browser can lead to full WordPress site compromise, making this functionally more dangerous than the numeric score suggests. PR:L (subscriber-level authentication required) is the key limiting factor: exploitation is not available to anonymous actors unless the target site permits open user registration, which many WordPress sites do. UI:R (user interaction required) further constrains the attack, requiring an administrator to load the affected page. No EPSS score was provided in the intelligence feed, and no KEV listing or public POC exists, which reduces urgency relative to actively exploited or weaponized vulnerabilities. The realistic threat actor for this vulnerability is a malicious registered user or a compromised low-privilege account, not an unauthenticated external attacker. Sites with registration disabled face substantially lower risk.

An attacker registers a subscriber account on a WordPress site with open registration enabled and running the vulnerable plugin version, then submits a crafted input containing a JavaScript payload to a plugin field accessible at subscriber privilege level. When an administrator subsequently loads the plugin management page or affected front-end view, the stored payload executes silently in the admin's browser, enabling session cookie theft or unauthorized administrative actions.