Executive brief
Cookie Law Bar is a WordPress plugin used to display cookie consent notifications to website visitors. A security flaw in version 1.2.1 allows an authorized user to inject malicious scripts into the notification bar's message field. If exploited, these scripts will run in the browsers of any visitor or administrator viewing the site, potentially leading to the theft of login cookies or other sensitive user information.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the Cookie Law Bar plugin for WordPress, specifically within the 'Bar Message' configuration field (clb_bar_msg). The vulnerability stems from a failure to sanitize user-supplied input before it is stored in the database and subsequently rendered on the front-end and back-end of the site. An authenticated attacker with access to the plugin settings page can inject arbitrary JavaScript payloads. Because the cookie bar is typically displayed on every page of the WordPress site, the injected script executes in the context of any user session, including administrators, facilitating session hijacking via cookie theft or unauthorized actions.
Affected products
- richplugins Cookie Law Bar 1.2.1
Timeline
- 2021-05-24: disclosed: Initial discovery and exploit publication by Mesut Cetin
- 2026-05-16: advisory: NVD/VulnCheck advisory published