Executive brief
The WPLP Cookie Consent WordPress plugin allows unauthenticated attackers to inject malicious JavaScript through a public endpoint that is later executed when administrators view logged consent data. An attacker can craft a malicious request to store JavaScript code that runs with administrative privileges when the admin interacts with the affected log entry, potentially compromising website security. This vulnerability only affects multisite WordPress installations and requires an administrator to view the injected log entry to trigger the attack.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the WPLP Cookie Consent plugin before version 4.4.4. The plugin receives user input through a public endpoint and fails to properly escape or sanitize the value before outputting it in a JavaScript context on the administrative consent logs page. An unauthenticated attacker can submit crafted input to the public endpoint that gets stored in the consent logs; when an administrator with elevated privileges accesses the administrative screen to view the logs, the unescaped JavaScript is executed in their browser session. This allows arbitrary code execution with administrative privileges, potentially leading to account takeover, malware injection, or further compromise of the WordPress installation. The vulnerability is fixed in version 4.4.4 and only affects multisite WordPress deployments.
Affected products
- WPLP Cookie Consent before 4.4.4
Timeline
- 2026-09-15: disclosed
- 2026-09-15: patched: Fixed in version 4.4.4