Wpconsent Cookie Banner Cookie Consent For Privacy Compliance Gdpr Ccpa Eu Compliance Cookie Notice
Monthly
Stored cross-site scripting in WPConsent (Cookie Banner & Cookie Consent for Privacy Compliance) through 1.1.9 allows unauthenticated attackers to inject arbitrary web scripts into comment content that execute when a user views an injected page. Exploitation is constrained: it requires the optional Script Blocking feature to be enabled, the ability to submit comments that are rendered, and two coordinated comments that place event-handler syntax in an allowed code element and the deterministic ___noise___ restoration key in an allowed abbr title attribute, with the key offset confirmable via an unauthenticated wpconsent_debug=1 request. No public exploit identified at time of analysis, and the assessed vector is AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N, so the non-default configuration and precise coordination limit realistic exploitation below the raw 7.2 score.
Stored cross-site scripting in WPConsent (Cookie Banner & Cookie Consent for Privacy Compliance) through 1.1.9 allows unauthenticated attackers to inject arbitrary web scripts into comment content that execute when a user views an injected page. Exploitation is constrained: it requires the optional Script Blocking feature to be enabled, the ability to submit comments that are rendered, and two coordinated comments that place event-handler syntax in an allowed code element and the deterministic ___noise___ restoration key in an allowed abbr title attribute, with the key offset confirmable via an unauthenticated wpconsent_debug=1 request. No public exploit identified at time of analysis, and the assessed vector is AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N, so the non-default configuration and precise coordination limit realistic exploitation below the raw 7.2 score.