Executive brief
The WPLP Cookie Consent plugin is a WordPress add-on that manages GDPR and CCPA cookie consent banners on websites. An attacker can inject malicious JavaScript code that will execute in the browsers of site visitors, potentially stealing session data, credentials, or redirecting users to malicious sites. No prior authentication is required since the vulnerability is accessible to any unauthenticated visitor.
Technical details
This is a Stored Cross-Site Scripting (XSS) vulnerability in the wpl_user_preference parameter of the WPLP Cookie Consent plugin (versions ≤4.4.1). The root cause is insufficient input sanitization and output escaping in the consent-logging AJAX endpoint. The endpoint is registered to accept unauthenticated requests, and the required nonce (wpl_consent_logging_nonce) is publicly exposed via wp_localize_script on the frontend, allowing any visitor to forge valid requests. An attacker can inject arbitrary JavaScript that persists and executes whenever users access the affected page. Patches addressing input sanitization and output escaping should be available in versions after 4.4.1.
Affected products
- WPLP Cookie Consent up to and including 4.4.1
Timeline
- 2026-09-09: disclosed