CVE-2026-13360 in WPLP Cookie Consent Plugin
Summary
by MITRE • 08/15/2026
The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regionArray' parameter in all versions up to, and including, 4.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires that the site administrator has enabled the 'Support Google Consent Mode (GCM)' setting, which is disabled by default. Additionally, the AJAX handler performs no nonce or capability check, allowing any authenticated user including those with Subscriber-level access to overwrite the affected plugin setting.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability in the WPLP Cookie Consent plugin for WordPress represents a critical stored cross-site scripting weakness that affects versions through 4.3.5, creating a persistent security risk for WordPress installations. This flaw stems from inadequate input validation and output escaping mechanisms within the plugin's handling of the 'regionArray' parameter, which allows malicious actors to inject malicious scripts that execute whenever users access affected pages. The vulnerability operates as a stored XSS attack because the injected code is permanently saved within the plugin's configuration settings rather than being reflected in HTTP responses, making it particularly dangerous as it can affect multiple users over time.
The exploitation scenario requires specific conditions that compound the threat level, as the vulnerability only activates when the site administrator has explicitly enabled the 'Support Google Consent Mode (GCM)' setting, which remains disabled by default. This dependency creates a layered attack vector where attackers must first identify vulnerable installations and then either convince administrators to enable the problematic setting or exploit the plugin's AJAX handler to make changes without proper authentication checks. The AJAX handler's lack of nonce verification and capability validation represents another critical weakness that allows any authenticated user, including those with minimal subscriber privileges, to modify core plugin settings.
The technical impact extends beyond simple script execution as this vulnerability enables attackers to potentially hijack user sessions, steal sensitive cookies, perform actions on behalf of users, or redirect them to malicious websites. The stored nature of the XSS means that even if administrators later disable the vulnerable setting or update the plugin, previously injected scripts continue to execute against all users who access affected pages. This persistent threat can be particularly damaging in enterprise environments where WordPress installations serve multiple users and sensitive data flows through these systems.
From a cybersecurity framework perspective, this vulnerability aligns with CWE-79 (Cross-site Scripting) and represents a clear violation of the principle of least privilege as demonstrated by the AJAX handler's failure to implement proper authentication checks. The ATT&CK framework categorizes this as a privilege escalation vector through application-specific weaknesses, where attackers leverage misconfigured plugin settings to gain unauthorized access to user sessions or data. Organizations should consider implementing network-level protections such as web application firewalls and content security policies as immediate mitigations while also addressing the root cause through prompt plugin updates.
The remediation process requires administrators to immediately update to versions beyond 4.3.5 where the input sanitization has been properly implemented, along with thorough auditing of existing plugin configurations for any previously injected malicious scripts. Security teams should conduct comprehensive vulnerability assessments across all WordPress installations to identify similar issues in other plugins and implement automated monitoring for unauthorized configuration changes. The incident highlights the importance of proper input validation and output escaping practices, particularly for plugins that handle user-facing configuration options and AJAX requests that could be exploited by attackers with minimal privileges.