Is CVE-2026-85130 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85130 being exploited in the wild.

How severe is CVE-2026-85130?

High severity, with a CVSS score of 8.8, published 17 September 2026.

Which products and versions are affected?

WPLP Cookie Consent before 4.4.4.

Is there a fix for CVE-2026-85130?

A patch was published on 2026-09-15: Fixed in version 4.4.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-85130 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-85130?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85130: WPLP Cookie Consent stored XSS via consent logs

CVE-2026-85130 · Severity: high · CVSS 8.8 · Published 2026-09-17

The WPLP Cookie Consent WordPress plugin allows unauthenticated attackers to inject malicious JavaScript through a public endpoint that is later executed when administrators view logged consent data. An attacker can craft a malicious request to store JavaScript code that runs with administrative privileges when the admin interacts with the affected log entry, potentially compromising website security. This vulnerability only affects multisite WordPress installations and requires an administrator to view the injected log entry to trigger the attack.

Quick answers

Is CVE-2026-85130 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85130 being exploited in the wild.
How severe is CVE-2026-85130?: High severity, with a CVSS score of 8.8, published 17 September 2026.
Which products and versions are affected?: WPLP Cookie Consent before 4.4.4.
Is there a fix for CVE-2026-85130?: A patch was published on 2026-09-15: Fixed in version 4.4.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85130 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-85130?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in the WPLP Cookie Consent plugin before version 4.4.4. The plugin receives user input through a public endpoint and fails to properly escape or sanitize the value before outputting it in a JavaScript context on the administrative consent logs page. An unauthenticated attacker can submit crafted input to the public endpoint that gets stored in the consent logs; when an administrator with elevated privileges accesses the administrative screen to view the logs, the unescaped JavaScript is executed in their browser session. This allows arbitrary code execution with administrative privileges, potentially leading to account takeover, malware injection, or further compromise of the WordPress installation. The vulnerability is fixed in version 4.4.4 and only affects multisite WordPress deployments.

Affected products

WPLP Cookie Consent before 4.4.4

Timeline

2026-09-15: disclosed
2026-09-15: patched: Fixed in version 4.4.4

References

https://wpscan.com/vulnerability/e48e363f-17e5-4b78-90b3-824c0bc47a23/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.