CVE-2026-14989

Deferred Deferred - Pending Action

Stored XSS in Cookie Banner for GDPR/CCPA – WPLP Cookie Consent WordPress Plugin

Publication date: 2026-09-09

Last updated on: 2026-09-09

Assigner: Wordfence

Description

The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpl_user_preference' parameter in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The consent-logging AJAX endpoint is registered for unauthenticated users and its required nonce (wpl_consent_logging_nonce) is publicly emitted via wp_localize_script on the frontend, meaning any unauthenticated site visitor can plant a payload without any prior authentication or privileged access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-09

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-14989

EUVD

EUVD-2026-74775

Affected Vendors & Products

Vendor	Product	Version / Range
wplp	cookie_consent	to 4.4.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the Cookie Banner for GDPR / CCPA – WPLP Cookie Consent WordPress plugin. It allows unauthenticated attackers to inject malicious scripts via the 'wpl_user_preference' parameter due to insufficient input sanitization and output escaping. The injected scripts execute when users access the affected pages.

Detection Guidance

Check WordPress sites using the Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin versions up to 4.4.1. Inspect stored XSS payloads in the 'wpl_user_preference' parameter via browser developer tools or database queries. Look for unusual script tags or encoded payloads in logged consent data.

Impact Analysis

Unauthenticated attackers can plant malicious scripts on your website without needing access credentials. These scripts can steal user data, session cookies, or perform actions on behalf of users. Visitors to your site may have their information compromised or be redirected to malicious sites.

Compliance Impact

This vulnerability can lead to non-compliance with GDPR and HIPAA as it may result in unauthorized access to user data. GDPR requires protecting user data and reporting breaches within 72 hours. HIPAA mandates safeguarding protected health information. Exploitation could trigger regulatory penalties and legal consequences.

Mitigation Strategies

Update the plugin to the latest version beyond 4.4.1 immediately. If an update is unavailable, disable the plugin temporarily. Review and sanitize all stored consent logs for malicious scripts. Implement strict input validation for the 'wpl_user_preference' parameter.

Hi! I’m here to help you understand CVE-2026-14989. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70