What is the CVSS score of EUVD-2025-19989?

EUVD-2025-19989 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Beautiful Cookie Consent Banner are affected by EUVD-2025-19989?

Beautiful Cookie Consent Banner WordPress plugin versions 4.6.1 and earlier contain a reflected cross-site scripting vulnerability that allows unauthenticated attackers to steal session tokens and…

How to fix or mitigate EUVD-2025-19989?

Within 24 hours, conduct an inventory of all WordPress installations to identify Beautiful Cookie Consent Banner deployments running version 4.6.1 or earlier and assess exposure. Within 7 days, implement Web Application Firewall (WAF) rules configured to block reflected XSS payloads, deploy strict Content Security Policy headers to prevent inline script execution, and disable or remove the plugin if functionally feasible. Within 30 days, monitor the vendor's security advisories for a patched release and prepare an immediate deployment plan; establish heightened monitoring for suspicious user account login patterns and consider issuing a password reset requirement for users with elevated privileges.

Beautiful Cookie Consent Banner EUVD-2025-19989

| CVE-2025-49866 HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-07-04 audit@patchstack.com

WordPress XSS Wordpress Plugin

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Reflected XSS with victim interaction; scope changes to browser; no availability impact applies to standard XSS.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 02:42 euvd

EUVD-2025-19989

Analysis Generated

Mar 16, 2026 - 02:42 vuln.today

CVE Published

Jul 04, 2025 - 12:15 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nikel Beautiful Cookie Consent Banner allows Reflected XSS. This issue affects Beautiful Cookie Consent Banner: from n/a through 4.6.1.

AnalysisAI

Reflected cross-site scripting in the Beautiful Cookie Consent Banner WordPress plugin (versions through 4.6.1) allows an unauthenticated attacker to inject arbitrary JavaScript into a victim's browser by tricking them into following a crafted URL. Successful exploitation can lead to session token theft, credential harvesting, or malicious redirect depending on attacker-controlled payload. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.03% reflects low current exploitation probability.

Technical ContextAI

The vulnerability is a classic reflected (non-persistent) XSS flaw (CWE-79: Improper Neutralization of Input During Web Page Generation) in the Beautiful Cookie Consent Banner plugin for WordPress, developed by Nikel. Reflected XSS arises when user-supplied input in an HTTP request is echoed back into the HTML response without adequate output encoding or sanitization. The CVSS scope metric is marked Changed (S:C), indicating that successful script injection escapes the plugin's own execution context into the victim's browser session, potentially affecting the full WordPress page. The affected surface is the WordPress plugin ecosystem, and the issue was identified and reported by Patchstack (audit@patchstack.com), a specialized WordPress security firm. Affected versions span all releases up to and including 4.6.1.

RemediationAI

The primary remediation is to update Beautiful Cookie Consent Banner to a version above 4.6.1 via the WordPress plugin dashboard or by downloading the latest release from the WordPress plugin repository. The exact patched release version is not independently confirmed in the available data - verify the current version in the WordPress plugin directory before updating. As a compensating control pending patch, site administrators can deactivate the plugin entirely if cookie consent functionality is not immediately required, accepting the trade-off of losing GDPR/cookie banner compliance messaging. Alternatively, deploying a web application firewall (WAF) rule blocking reflected XSS payloads in query parameters associated with the plugin's endpoints can reduce risk without disabling the plugin, though WAF rules may produce false positives on legitimate parameter values. Restricting administrator access to clicking unknown external links via security awareness training reduces the practical impact given the UI:R requirement.