CVE-2026-97640
Received Received - Intake

WPConsent Plugin Stored XSS via Comment Content

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Wordfence

Description
The WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS) in all versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the Script Blocking feature to be enabled, and the exploit chain depends on an attacker submitting two coordinated comments — one embedding event-handler syntax inside an allowed <code> element and one placing the deterministic ___noise___ restoration key inside an allowed <abbr title=""> attribute — with the key offset confirmable via an unauthenticated wpconsent_debug=1 request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-97640
EUVD
EUVD-2026-102799

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
smub WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the WPConsent WordPress plugin. It allows unauthenticated attackers to inject malicious scripts into web pages by exploiting insufficient input sanitization and output escaping. The attack requires the Script Blocking feature to be enabled and involves submitting two coordinated comments with specific HTML elements and a restoration key.

Detection Guidance

Check for suspicious comments containing event-handler syntax or ___noise___ keys in WordPress posts. Use wpconsent_debug=1 to verify restoration key offsets. Inspect pages for unexpected script execution in injected content.

Impact Analysis

This vulnerability can allow attackers to execute arbitrary web scripts on pages viewed by users. This could lead to theft of sensitive data, session hijacking, or defacement of the website. Users visiting an infected page may unknowingly run malicious scripts, compromising their data or account.

Compliance Impact

This vulnerability undermines compliance with GDPR, CCPA, and other privacy regulations by exposing user data to potential theft or manipulation. It violates principles of data protection and security, potentially leading to legal penalties, reputational damage, and loss of user trust.

Mitigation Strategies

Update the WPConsent plugin to the latest version beyond 1.1.9. Disable the Script Blocking feature if enabled. Review and remove suspicious comments with event-handler syntax or ___noise___ keys.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97640. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart