Junglewise Threat Intelligence

CVE-2026-8977: WP GDPR Cookie Consent Stored XSS in ninja_gdpr_ajax_actions

CVE-2026-8977 · Severity: medium · CVSS 6.4 · Published 2026-06-09

Executive brief

The WP GDPR Cookie Consent plugin for WordPress, which helps websites manage user privacy compliance, contains a security flaw that allows logged-in users with low-level permissions to inject malicious scripts into the site. These scripts can execute in the browsers of other visitors or administrators, potentially leading to unauthorized actions or data theft. This vulnerability affects all versions of the plugin up to 1.0.0.

Technical details

The vulnerability is a Stored Cross-Site Scripting (XSS) flaw rooted in the 'ninja_gdpr_ajax_actions' AJAX action. The 'handleAjaxCalls()' function fails to implement proper capability and nonce checks, allowing low-privileged authenticated users (subscriber and above) to modify configuration values. Furthermore, the 'gdprConfig' values lack sufficient input sanitization, and the 'generateCSS()' function fails to escape these values before echoing them into a <style> block in the 'wp_head' section. An attacker can exploit this to inject malicious JavaScript that executes in the context of any user visiting the site.

Affected products

  • WP GDPR Cookie Consent WP GDPR Cookie Consent up to, and including, 1.0.0

Timeline

  • 2026-06-09: advisory: Initial disclosure by Wordfence and NVD publication.

References