CVE-2026-92977

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-03

Last updated on: 2026-10-06

Assigner: Wordfence

Description

The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Malicious script payloads placed in the title attribute of an anchor tag survive WordPress's comment kses filter at save time, as the payload is only promoted to executable HTML attributes when the plugin's page-wide regex strips the closing quote delimiter at render time; exploitability is therefore subject to the standard comment moderation workflow before the comment is publicly displayed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-03

Last Modified

2026-10-06

Generated

2026-10-19

AI Q&A

2026-10-03

EPSS Evaluated

2026-10-18

NVD

CVE-2026-92977

EUVD

EUVD-2026-91892

Affected Vendors & Products

Vendor	Product	Version / Range
devowl	Real	Cookie Banner: GDPR & ePrivacy Cookie Consent 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the Real Cookie Banner plugin for WordPress. It allows unauthenticated attackers to inject malicious scripts into web pages via comments due to insufficient input sanitization and output escaping. The injected scripts execute when users access the affected pages.

Detection Guidance

This vulnerability is specific to the Real Cookie Banner WordPress plugin. To detect it, check if your WordPress site uses the plugin version 5.3.5 or older. You can do this by inspecting the plugin files or checking the WordPress admin panel under Plugins. Look for comments containing suspicious scripts or payloads in the title attribute of anchor tags.

Impact Analysis

An attacker could exploit this to steal user data, hijack sessions, or perform actions on behalf of users. Since the payload survives WordPress's comment filter, it may execute even after moderation if the plugin's regex removes quote delimiters during rendering.

Compliance Impact

This vulnerability could lead to unauthorized data access or manipulation, violating GDPR's data protection principles or HIPAA's security requirements. It may result in non-compliance due to potential exposure of user data or compromised consent mechanisms.

Mitigation Strategies

Immediately update the Real Cookie Banner plugin to the latest version. If an update is not available, consider disabling or removing the plugin until a patch is released. Review all comments on your site for malicious scripts, especially those in anchor tags with title attributes. Enable strict comment moderation to prevent unauthorized scripts from being published.

Hi! I’m here to help you understand CVE-2026-92977. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70