CVE-2026-73359

MediumCVSS 6.5

Published: 18/08/2026(UTC)Updated: 20/08/2026(UTC)Translated: 18/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

12th percentile - higher than 12% of all known CVEs

Summary

Cross Site Scripting (XSS) vulnerability in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions up to 4.3.9. The attack requires subscriber-level privileges.

Risk Assessment

A subscriber-level user can inject malicious scripts, potentially leading to session theft, account takeover, or other attacks on users.

Recommendation

Update the WP Cookie Notice plugin to the latest version that includes the fix.

Original NVD description (English source)

Subscriber Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.3.9 versions.