Stored XSS in The Real Cookie Banner WordPress Plugin

The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 5.3.5. The vulnerability stems from insufficient input sanitization and output escaping when handling content within comment anchor tags. Unauthenticated attackers can inject malicious payloads into the title attribute of these tags, which successfully bypass the default WordPress comment kses filter.

The exploitation relies on the plugin's internal rendering logic, specifically a page-wide regex operation that strips the closing quote delimiter of the title attribute at render time. This transformation converts the payload from a benign attribute value into executable HTML. While the exploitation requires the injected comment to survive the site's standard comment moderation workflow, successful execution allows attackers to run arbitrary scripts in the session of any user viewing the page, potentially leading to session hijacking, site defacement, or administrative account compromise if viewed by privileged users.

Attack Chain

1. Attacker crafts a malicious payload containing an XSS vector within the title attribute of an anchor tag (e.g., <a title='x' onmouseover=alert(1) '>).
2. Attacker submits the payload through the WordPress comment form.
3. The WordPress 'kses' filter processes the comment but fails to properly sanitize the title attribute of the anchor tag, allowing the payload to be saved to the database.
4. The malicious comment enters the site's moderation queue awaiting approval.
5. An administrator or moderator reviews and approves the malicious comment, moving it to a public-facing page.
6. A target user visits the page containing the malicious comment.
7. The Real Cookie Banner plugin processes the page, and its regex strips the closing quote delimiter of the title attribute.
8. The malicious script is rendered as valid HTML in the victim's browser and executes with the privileges of the victim's session.

Impact

Successful exploitation of this vulnerability allows for the execution of arbitrary JavaScript in the context of the victim's browser session. If a site administrator views a page containing the malicious payload, the attacker could potentially perform actions on behalf of the administrator, lead to unauthorized configuration changes, or exfiltrate sensitive site data. The vulnerability affects any WordPress site running the vulnerable version of the Real Cookie Banner plugin that permits user comments.

Recommendation

Prioritize the update of the Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin to the latest available version beyond 5.3.5 to mitigate CVE-2026-92977. Ensure that the WordPress comment moderation workflow is configured to require manual approval for all comments to prevent unauthenticated injection attempts from immediately becoming publicly visible. Conduct a review of recently approved comments for any suspicious anchor tag attributes.