CVE-2026-13360
Received Received - Intake

Stored XSS in Cookie Banner for GDPR / CCPA – WPLP Cookie Consent WordPress Plugin

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: Wordfence

Description
The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regionArray' parameter in all versions up to, and including, 4.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires that the site administrator has enabled the 'Support Google Consent Mode (GCM)' setting, which is disabled by default. Additionally, the AJAX handler performs no nonce or capability check, allowing any authenticated user including those with Subscriber-level access to overwrite the affected plugin setting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-13360
EUVD
EUVD-2026-58863

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wplp cookie_consent to 4.3.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress. It exists due to insufficient input sanitization and output escaping in the 'regionArray' parameter. Unauthenticated attackers can inject malicious scripts into pages, which execute when users access those pages. Exploitation requires the site administrator to have enabled the 'Support Google Consent Mode (GCM)' setting, which is off by default.

Detection Guidance

This vulnerability can be detected by checking if the 'Cookie Banner for GDPR / CCPA – WPLP Cookie Consent' plugin is installed and active on your WordPress site. Inspect the plugin version and verify if it is up to, and including, 4.3.5. Look for suspicious scripts in pages where the plugin is active, particularly those related to the 'regionArray' parameter.

Impact Analysis

This vulnerability allows attackers to inject arbitrary scripts into your WordPress site. If exploited, these scripts can steal user data, session cookies, or perform actions on behalf of users. It may also lead to defacement of your website or spreading malware to visitors. The impact depends on the injected script's purpose and the site's user base.

Compliance Impact

This vulnerability can compromise compliance with GDPR and other privacy regulations by enabling unauthorized data access or modification. GDPR requires protecting user data and ensuring website security. A successful XSS attack could lead to data breaches, violating GDPR's integrity and confidentiality principles. HIPAA-covered entities must also ensure ePHI protection, which this flaw could undermine.

Mitigation Strategies
  • Update the 'Cookie Banner for GDPR / CCPA – WPLP Cookie Consent' plugin to the latest version, if available, to patch the vulnerability.
  • Disable the 'Support Google Consent Mode (GCM)' setting in the plugin if it is enabled, as this is a prerequisite for exploitation.
  • Review and remove any unauthorized scripts or modifications made via the 'regionArray' parameter in the plugin settings.
  • Implement strict input validation and output escaping for all plugin parameters to prevent XSS attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13360. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart