Cross-site scripting in wplegalpages WPLP Cookie Consent – Cookie Banner & Consent…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regionArray' parameter in all versions up to, and including, 4.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires that the site administrator has enabled the 'Support Google Consent Mode (GCM)' setting, which is disabled by default. Additionally, the AJAX handler performs no nonce or capability check, allowing any authenticated user including those with Subscriber-level access to overwrite the affected plugin setting.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| wplegalpages | WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode | up to 4.3.5 | — | No fix listed | CNA |
- WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode Vendorwplegalpages Affected up to 4.3.5 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-13360
- 2026-10-03 Alias added: GHSA-wj5r-wjwf-mg3q
References
Other 8
- https://www.wordfence.com/threat-intel/vulnerabilities/id/bba8007f-7254-4201-8f94-7bf921a33a27?source=cve
- https://plugins.trac.wordpress.org/browser/gdpr-cookie-consent/tags/4.3.5/public/class-gdpr-cookie-consent-public.php#L209
- https://plugins.trac.wordpress.org/browser/gdpr-cookie-consent/tags/4.3.5/admin/class-gdpr-cookie-consent-admin.php#L4961
- https://plugins.trac.wordpress.org/browser/gdpr-cookie-consent/tags/4.3.5/includes/class-gdpr-cookie-consent.php#L245
- https://plugins.trac.wordpress.org/browser/gdpr-cookie-consent/tags/4.2.7/public/class-gdpr-cookie-consent-public.php#L209
- https://plugins.trac.wordpress.org/browser/gdpr-cookie-consent/tags/4.2.7/admin/class-gdpr-cookie-consent-admin.php#L4961
- https://plugins.trac.wordpress.org/browser/gdpr-cookie-consent/tags/4.2.7/includes/class-gdpr-cookie-consent.php#L245
- https://plugins.trac.wordpress.org/changeset/3641387/gdpr-cookie-consent/tags/4.4.0/admin/class-gdpr-cookie-consent-admin.php
More wplegalpages vulnerabilities
- TI-2026-53108 WPLP Cookie Consent <= 4.4.1 - Unauthenticated Arbitrary File Upload via 'upload-logo' REST Endpoint CVSS 3.1CRITICAL 9.8
- TI-2026-57227 WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.1 - Arbitrary File Upload vulnerability CVSS 3.1CRITICAL 10.0
- TI-2025-41583 WordPress WPLegalPages plugin <= 3.5.4 - Broken Access Control vulnerability CVSS 3.1HIGH 7.5
- TI-2025-10775 Missing authorization in wplegalpages Cookie Banner for GDPR / CCPA – WPLP Cookie Consent CVSS 3.1HIGH 7.5
- TI-2026-54431 WordPress WPLegalPages plugin <= 3.7.0 - Broken Authentication vulnerability CVSS 3.1HIGH 7.3
- TI-2026-12620 Cookie Banner for GDPR / CCPA <= 4.4.1 - Unauthenticated Stored Cross-Site Scripting via 'wpl_user_preference' Parameter CVSS 3.1HIGH 7.2
Sources
- CVE-2026-13360 · CVE Program
- CVE-2026-13360 · NVD
- FIRST EPSS
- GHSA-wj5r-wjwf-mg3q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences