Stored Cross-Site Scripting Vulnerability in WP GDPR Cookie Consent by WordPress

CVE-2026-8977

What is CVE-2026-8977?

The WP GDPR Cookie Consent plugin for WordPress has a stored cross-site scripting vulnerability that arises from inadequate capability and nonce checks in the handleAjaxCalls() function. This security flaw allows authenticated users with subscriber-level access or higher to manipulate gdprConfig input without sufficient sanitization. Consequently, malicious scripts can be injected and executed in the context of users accessing affected pages, compromising user data and site integrity whenever the injected page is accessed.

References