Stored Cross-Site Scripting Vulnerability in Cookie Consent for Developers Plugin by WordPress

CVE-2026-1084

What is CVE-2026-1084?

The Cookie Consent for Developers plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping. This vulnerability allows authenticated attackers with administrator privileges to inject malicious web scripts into multiple settings fields. These scripts execute when a user accesses affected pages, potentially compromising user data. The issue is specifically relevant in multi-site installations and where the 'unfiltered_html' capability has been disabled. Ensuring proper security measures and updating to the latest versions is imperative to mitigate this risk.

References