CVE-2026-85130
UnknownSummary
The WPLP Cookie Consent WordPress plugin before 4.4.4 does not escape a value submitted through a public endpoint for the JavaScript context it is later output in on an administrative screen, allowing unauthenticated users to run arbitrary JavaScript in the session of an administrator who interacts with the logged entry. Only multisite installations are affected.
Risk Assessment
An attacker can execute malicious scripts in the context of an administrator's session, potentially leading to administrator account takeover or unauthorized actions in the admin panel.
Recommendation
Update the WPLP Cookie Consent plugin to version 4.4.4 or later. Restrict access to public endpoints and regularly review admin logs for suspicious entries.
Other vulnerabilities in WPLP Cookie Consent WordPress plugin
See all- CVE-2026-85133Medium
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on several of its settings AJAX actions, allowing any authenticated user, such as a subscriber, to read and destroy scan data belonging to the administrator and to overwrite the plugin's stored configuration.
- CVE-2026-85132Medium
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on one of its cookie scanner AJAX actions, allowing any authenticated user, such as a subscriber, to read back the automated scan schedule the administrator configured.
Original NVD description (English source)
The WPLP Cookie Consent WordPress plugin before 4.4.4 does not escape a value submitted through a public endpoint for the JavaScript context it is later output in on an administrative screen, allowing unauthenticated users to run arbitrary JavaScript in the session of an administrator who interacts with the logged entry. Only multisite installations are affected.