Real Cookie Banner EUVD-2026-91892

Exploitation requires (1) the target site to allow comment submission, (2) the crafted anchor-tag/title-attribute payload to pass WordPress's comment kses sanitization at save time, (3) the comment to be approved through the standard comment moderation workflow before public display, and (4) the Real Cookie Banner plugin (≤5.3.5) to render the page so its page-wide regex strips the closing quote delimiter and promotes the payload to an executable attribute. Limiting factors: manual comment moderation is the primary gate - sites requiring human approval of first-time commenters significantly blunt this; sites that auto-approve comments remove that barrier. The attacker needs no authentication (PR:N), but the attack is passive until a victim loads the injected page.

Signals here conflict in an instructive way. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2 HIGH) paints this as a trivially exploitable remote unauthenticated stored XSS, but the description materially undercuts that: the payload only becomes executable through a specific plugin-side regex that strips the closing quote delimiter at render time, AND the malicious comment must first pass WordPress's standard comment moderation workflow before it is publicly displayed. Both of those are real barriers that the AC:L/UI:N rating does not capture - exploitation is not a straightforward one-shot injection against a default install. No EPSS score, KEV listing, or POC availability was provided in the input, so there is no evidence of active exploitation or public exploit code; exploitation status is therefore 'no public exploit identified at time of analysis.' Net assessment: this is a legitimate stored XSS worth patching, but it is a moderate real-world priority rather than an emergency - the moderation gate and the dependency on a specific rendering quirk make opportunistic mass exploitation unlikely. It ranks below an unconditioned PR:N/UI:N stored XSS despite the identical headline score. Verify the moderation assumption against your own site configuration, since sites that auto-approve comments (or auto-approve for previously-approved commenters) remove the primary limiting factor.

An unauthenticated attacker submits a blog comment containing an anchor tag whose title attribute carries a script payload crafted to survive WordPress's comment kses filter at save time. After the comment is approved through normal moderation, the Real Cookie Banner plugin's page-wide regex strips the closing quote delimiter during rendering, promoting the payload into an executable HTML attribute so the script runs in the browser of every visitor who loads the affected page. No public exploit code was identified in the provided data.