Cross-Site Scripting Vulnerability in WPLP Cookie Consent Plugin by WordPress
CVE-2026-85130
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 17 September 2026
Badges
What is CVE-2026-85130?
The WPLP Cookie Consent plugin for WordPress, prior to version 4.4.4, is susceptible to a cross-site scripting (XSS) vulnerability. This arises from the failure to properly escape values submitted through a public endpoint, which are later rendered in the JavaScript context on an administrative screen. As a result, unauthorized users can exploit this flaw to execute arbitrary JavaScript in the session of an administrator who interacts with the logged entry. This vulnerability specifically affects multisite installations, posing a significant risk to the integrity of administrative sessions.
Affected Version(s)
WPLP Cookie Consent 0 < 4.4.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.