Wp Cookie Notice For Gdpr Ccpa Eprivacy Consent
Monthly
Stored Cross-Site Scripting in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent (≤4.3.9) is exploitable by any authenticated subscriber-level WordPress user, allowing injection of persistent JavaScript that executes when a higher-privileged user such as an administrator views the affected content. The scope-changed CVSS metric (S:C) reflects the real danger: a successful payload can hijack an admin session, modify site content, or silently escalate attacker privileges. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Stored Cross-Site Scripting in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent (≤4.3.9) is exploitable by any authenticated subscriber-level WordPress user, allowing injection of persistent JavaScript that executes when a higher-privileged user such as an administrator views the affected content. The scope-changed CVSS metric (S:C) reflects the real danger: a successful payload can hijack an admin session, modify site content, or silently escalate attacker privileges. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.