Description

The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regionArray' parameter in all versions up to, and including, 4.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires that the site administrator has enabled the 'Support Google Consent Mode (GCM)' setting, which is disabled by default. Additionally, the AJAX handler performs no nonce or capability check, allowing any authenticated user including those with Subscriber-level access to overwrite the affected plugin setting.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-15T04:18:01.957Z",
  "pubdate": "2026-08-15T04:18:01.957Z",
  "executiveSummary": "The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress in all versions up to, and including, 4.3.5 is vulnerable to Stored Cross-Site Scripting (XSS).\nThis vulnerability allows unauthenticated or low-privileged attackers to inject arbitrary web scripts into pages, which subsequently execute whenever a user accesses the affected page.\nThe flaw stems from insufficient input sanitization and output escaping applied to the 'regionArray' parameter.\nSuccessful exploitation requires the site administrator to have enabled the 'Support Google Consent Mode (GCM)' setting, which is disabled by default.\nAdditionally, the AJAX handler responsible for updating settings performs no nonce validation or capability checks, allowing any authenticated user with Subscriber-level access to overwrite the target plugin setting.\nThe risk implication includes potential session hijacking, unauthorized administrative actions, and defacement of the WordPress site when exploited in conjunction with the required configuration and AJAX vector.",
  "technicalDetails": "The vulnerability is classified as Stored Cross-Site Scripting (XSS), facilitated by improper input sanitization and output escaping within the Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress.\nThe affected component is the plugin's AJAX handler associated with settings management, specifically processing the 'regionArray' parameter.\nAll versions up to, and including, 4.3.5 are affected.\nThe attack vector involves two primary weaknesses: first, the AJAX handler lacks any nonce generation or verification mechanism, and second, it enforces no capability checks, enabling any authenticated user possessing Subscriber-level privileges to interact with the handler.\nFurthermore, exploitation is contingent upon the site administrator having explicitly enabled the 'Support Google Consent Mode (GCM)' setting, which remains disabled by default.\nThe attack flow proceeds as follows: an attacker with Subscriber-level access crafts a malicious request targeting the vulnerable AJAX handler. Because the endpoint fails to validate nonces or verify user capabilities, the request is processed successfully.\nThe attacker supplies a malicious payload containing arbitrary JavaScript within the 'regionArray' parameter.\nDue to insufficient input sanitization and subsequent lack of output escaping when rendering the data, the injected script is persistently stored within the database or plugin configuration.\nWhen any user, including high-privileged administrators, navigates to a page rendering the affected configuration, the injected payload executes within the context of their browser session.\nThe post-exploitation impact includes the execution of arbitrary scripts, potential theft of session cookies, redirection to malicious resources, or the performance of unauthorized actions on behalf of authenticated users visiting the injected pages."
}