Stored Cross-Site Scripting Vulnerability in Cookie Notice & Consent Plugin for WordPress

CVE-2025-10496

What is CVE-2025-10496?

The Cookie Notice & Consent plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping in the uuid parameter. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts into web pages, which may execute whenever a user accesses an affected page. All versions up to and including 1.6.5 are impacted. It is crucial for users of this plugin to apply necessary patches and implement security measures to mitigate potential exploitation.

References