EUVD-2026-35310
GHSA-3vwc-x4cp-8232
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The WP GDPR Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ninja_gdpr_ajax_actions' AJAX action in versions up to, and including, 1.0.0. This is due to missing capability and nonce checks on the handleAjaxCalls() function, combined with insufficient input sanitization on the gdprConfig values and missing output escaping in the generateCSS() function which echoes stored configuration values directly into a <style> block rendered on wp_head. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in the WP GDPR Cookie Consent WordPress plugin (versions up to and including 1.0.0, by techjewel) allows authenticated attackers with subscriber-level access to inject persistent malicious scripts into pages served to all site visitors. The vulnerability chains three distinct weaknesses in the handleAjaxCalls() function: absent capability verification, missing nonce validation, and unsanitized gdprConfig values that are echoed verbatim by generateCSS() into a <style> block on wp_head. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low privilege bar (subscriber-level) and changed scope (S:C) make this a meaningful risk for multi-user WordPress sites.
Technical ContextAI
The affected component is the WP GDPR Cookie Consent plugin (CPE: cpe:2.3:a:techjewel:wp_gdpr_cookie_consent:*:*:*:*:*:*:*:*), a WordPress plugin by techjewel designed to manage GDPR cookie consent banners. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS). Three cooperating weaknesses are present: (1) the handleAjaxCalls() function registered under the 'ninja_gdpr_ajax_actions' AJAX hook performs no WordPress capability check (e.g., current_user_can()) and no nonce validation, allowing any authenticated user regardless of role to invoke it; (2) gdprConfig values submitted via this AJAX endpoint are stored without adequate sanitization; and (3) the generateCSS() function at GdprHandler.php:L169 echoes those stored configuration values directly into a <style> block injected via wp_head, with no output escaping. The CVSS Scope:Changed designation reflects that injected scripts execute in the browser context of any visitor, crossing the trust boundary from the attacker's session to all users of the affected WordPress site.
RemediationAI
No vendor-released patched version has been confirmed in the available data - the CPE wildcard and absence of a fixed-version reference in any advisory or trac changelog entry indicate a patch may not yet be publicly released. Site administrators should immediately check the WordPress plugin repository for an update beyond version 1.0.0 and apply it if available. Until a patch is confirmed, the most effective compensating control is to deactivate and remove the WP GDPR Cookie Consent plugin entirely; this eliminates the attack surface with no functional trade-off beyond losing the cookie consent banner, which can be replaced by an alternative plugin. If removal is not possible, restricting user registration to prevent untrusted subscriber accounts (Settings > General > uncheck 'Anyone can register') will raise the effective privilege bar and limit exploitation to already-trusted users, though this does not eliminate the vulnerability. Network-level WAF rules targeting the 'ninja_gdpr_ajax_actions' AJAX action parameter in POST requests to wp-admin/admin-ajax.php can add a detection layer but should not be relied upon as a primary control. Wordfence's advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/95c7f999-3676-4b91-9ee0-f55a27bcd93c should be monitored for patch confirmation.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today