Stored Cross-Site Scripting Vulnerability in WPConsent Cookie Banner Plugin
CVE-2026-97640

7.2HIGH

Key Information:

Vendor

WordPress
Status
WPconsent – Cookie Banner & Cookie Consent For Privacy Compliance (gdpr / Ccpa / Eu Compliance Cookie Notice)
Vendor
CVE Published:
16 October 2026

What is CVE-2026-97640?

The WPConsent plugin for WordPress is susceptible to stored Cross-Site Scripting due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts. This vulnerability, found in all versions up to and including 1.1.9, requires the Script Blocking feature to be enabled and involves a coordinated attack using crafted comments to exploit the Simple HTML DOM Parser. An attacker can leverage this flaw to execute malicious scripts in the context of a user's session, posing significant risks to user privacy and website security.

Affected Version(s)

WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) 0 <= 1.1.9

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/wpconsent-cook...
https://plugins.trac.wordpress.org/browser/wpconsent-cook...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

daroo
.