# CVE-2026-14989: WPLP Cookie Consent stored cross-site scripting via wpl_user_preference

Source: https://junglewise.ai/threats/cve-2026-14989-wplp-cookie-consent-stored-cross-site-scripting-via-wpl-user  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-09. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-14989 · Severity: high · CVSS 7.2 · Published 2026-09-09

The WPLP Cookie Consent plugin is a WordPress add-on that manages GDPR and CCPA cookie consent banners on websites. An attacker can inject malicious JavaScript code that will execute in the browsers of site visitors, potentially stealing session data, credentials, or redirecting users to malicious sites. No prior authentication is required since the vulnerability is accessible to any unauthenticated visitor.

## Quick answers

**Is CVE-2026-14989 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14989 being exploited in the wild.

**How severe is CVE-2026-14989?** High severity, with a CVSS score of 7.2, published 9 September 2026.

**Which products and versions are affected?** WPLP Cookie Consent up to and including 4.4.1.

**Is there a fix for CVE-2026-14989?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-14989 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-14989?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a Stored Cross-Site Scripting (XSS) vulnerability in the wpl_user_preference parameter of the WPLP Cookie Consent plugin (versions ≤4.4.1). The root cause is insufficient input sanitization and output escaping in the consent-logging AJAX endpoint. The endpoint is registered to accept unauthenticated requests, and the required nonce (wpl_consent_logging_nonce) is publicly exposed via wp_localize_script on the frontend, allowing any visitor to forge valid requests. An attacker can inject arbitrary JavaScript that persists and executes whenever users access the affected page. Patches addressing input sanitization and output escaping should be available in versions after 4.4.1.

## Affected products

- WPLP Cookie Consent up to and including 4.4.1

## Timeline

- 2026-09-09: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/gdpr-cookie-consent/tags/4.2.7/public/modules/consent-logs/class-wpl-consent-logs.php](https://plugins.trac.wordpress.org/browser/gdpr-cookie-consent/tags/4.2.7/public/modules/consent-logs/class-wpl-consent-logs.php)
- [https://plugins.trac.wordpress.org/browser/gdpr-cookie-consent/tags/4.2.7/public/modules/consent-logs/class-wpl-cookie-consent-consent-logs.php](https://plugins.trac.wordpress.org/browser/gdpr-cookie-consent/tags/4.2.7/public/modules/consent-logs/class-wpl-cookie-consent-consent-logs.php)