Executive brief
WPLP Cookie Consent is a WordPress plugin that manages cookie consent banners for GDPR and CCPA compliance. The plugin contains a stored cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into website pages, which will execute when users visit the affected site. This could enable credential theft, malware distribution, or defacement of the website.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the 'regionArray' parameter due to insufficient input sanitization and output escaping. The AJAX handler lacks nonce and capability checks, allowing any authenticated user—including those with minimal Subscriber-level permissions—to inject and persist malicious JavaScript. Exploitation requires that the site administrator has enabled the 'Support Google Consent Mode (GCM)' setting, which is off by default. Once injected, the malicious script executes in the browsers of all users who visit pages containing the affected plugin setting.
Affected products
- WPLP Cookie Consent up to and including 4.3.5
Timeline
- 2026-08-15: disclosed