What is the CVSS score of CVE-2026-8977?

CVE-2026-8977 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WP GDPR Cookie Consent CVE-2026-8977

EUVD-2026-35310 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 Wordfence

GHSA-3vwc-x4cp-8232

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 05:12 vuln.today

CVE Published

Jun 09, 2026 - 03:41 nvd

MEDIUM 6.4

DescriptionCVE.org

The WP GDPR Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ninja_gdpr_ajax_actions' AJAX action in versions up to, and including, 1.0.0. This is due to missing capability and nonce checks on the handleAjaxCalls() function, combined with insufficient input sanitization on the gdprConfig values and missing output escaping in the generateCSS() function which echoes stored configuration values directly into a <style> block rendered on wp_head. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the WP GDPR Cookie Consent WordPress plugin (versions up to and including 1.0.0, by techjewel) allows authenticated attackers with subscriber-level access to inject persistent malicious scripts into pages served to all site visitors. The vulnerability chains three distinct weaknesses in the handleAjaxCalls() function: absent capability verification, missing nonce validation, and unsanitized gdprConfig values that are echoed verbatim by generateCSS() into a <style> block on wp_head. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low privilege bar (subscriber-level) and changed scope (S:C) make this a meaningful risk for multi-user WordPress sites.

Technical ContextAI

The affected component is the WP GDPR Cookie Consent plugin (CPE: cpe:2.3:a:techjewel:wp_gdpr_cookie_consent:*:*:*:*:*:*:*:*), a WordPress plugin by techjewel designed to manage GDPR cookie consent banners. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS). Three cooperating weaknesses are present: (1) the handleAjaxCalls() function registered under the 'ninja_gdpr_ajax_actions' AJAX hook performs no WordPress capability check (e.g., current_user_can()) and no nonce validation, allowing any authenticated user regardless of role to invoke it; (2) gdprConfig values submitted via this AJAX endpoint are stored without adequate sanitization; and (3) the generateCSS() function at GdprHandler.php:L169 echoes those stored configuration values directly into a <style> block injected via wp_head, with no output escaping. The CVSS Scope:Changed designation reflects that injected scripts execute in the browser context of any visitor, crossing the trust boundary from the attacker's session to all users of the affected WordPress site.

RemediationAI

No vendor-released patched version has been confirmed in the available data - the CPE wildcard and absence of a fixed-version reference in any advisory or trac changelog entry indicate a patch may not yet be publicly released. Site administrators should immediately check the WordPress plugin repository for an update beyond version 1.0.0 and apply it if available. Until a patch is confirmed, the most effective compensating control is to deactivate and remove the WP GDPR Cookie Consent plugin entirely; this eliminates the attack surface with no functional trade-off beyond losing the cookie consent banner, which can be replaced by an alternative plugin. If removal is not possible, restricting user registration to prevent untrusted subscriber accounts (Settings > General > uncheck 'Anyone can register') will raise the effective privilege bar and limit exploitation to already-trusted users, though this does not eliminate the vulnerability. Network-level WAF rules targeting the 'ninja_gdpr_ajax_actions' AJAX action parameter in POST requests to wp-admin/admin-ajax.php can add a detection layer but should not be relied upon as a primary control. Wordfence's advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/95c7f999-3676-4b91-9ee0-f55a27bcd93c should be monitored for patch confirmation.