Stored XSS in WPLP Cookie Consent Plugin for WordPress

The Cookie Banner for GDPR / CCPA - WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 4.4.1. The flaw stems from insufficient input sanitization and output escaping within the 'wpl_user_preference' parameter. An unauthenticated attacker can exploit this vulnerability because the plugin's AJAX endpoint for consent logging is accessible to all site visitors. Furthermore, the required security nonce (wpl_consent_logging_nonce) is improperly exposed via wp_localize_script on the frontend. This allows an attacker to obtain the nonce without authentication and submit a request containing a malicious payload, which is then stored by the server. When other users or administrators visit the affected page, the stored script executes in their browser context, potentially leading to session hijacking or unauthorized administrative actions.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of other users' browsers. This can lead to account takeover, unauthorized modification of site content, or the redirection of users to malicious external domains. Given the plugin's purpose, it is likely deployed on a wide range of WordPress-based websites, increasing the potential for large-scale exploitation across different sectors.

Recommendation

1. Update the WPLP Cookie Consent plugin to the latest available version (beyond 4.4.1) immediately to patch the sanitization logic.
2. Audit WordPress access logs for anomalous POST requests directed at the plugin's AJAX consent-logging endpoints.
3. Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized inline scripts and external resources on the site.