Stored Cross-Site Scripting in WPConsent WordPress Plugin

The WPConsent - Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to, and including, 1.1.9. The vulnerability arises due to insufficient input sanitization and output escaping when the "Script Blocking" feature is active. An unauthenticated attacker can exploit this via mutation XSS (mXSS), specifically by leveraging the plugin's Simple HTML DOM Parser to manipulate how content is rendered. This flaw allows an attacker to inject arbitrary web scripts into WordPress pages, which then execute when an unsuspecting user visits the affected page. The exploit requires chaining two specific comment submissions and using a debug parameter to verify injection offsets, posing a significant risk to site administrators and users.

Attack Chain

1. Attacker enables or identifies a target WordPress site using the vulnerable WPConsent plugin with the "Script Blocking" feature enabled.
2. Attacker performs an unauthenticated request to the site with the parameter wpconsent_debug=1 to retrieve the deterministic ___noise___ restoration key and determine the current injection offset.
3. Attacker submits the first comment containing malicious event-handler syntax (e.g., onmouseover) embedded inside a permitted <code> HTML element.
4. Attacker submits a second, coordinated comment containing the required ___noise___ restoration key placed within an allowed <abbr title=""> attribute.
5. The plugin's Simple HTML DOM Parser processes these comments, causing the stored payloads to mutate and break out of the intended HTML tag structure.
6. The injected script is successfully stored on the server side as part of the comment section of a post or page.
7. A legitimate user or administrator visits the page containing the malicious comments.
8. The browser renders the mutated HTML, triggering the execution of the attacker's script in the context of the user's browser session.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of a victim's browser session. This can lead to the theft of session cookies, administrative account takeover, unauthorized modification of site content, or the redirection of users to malicious external domains. As this plugin is designed for privacy compliance, an attacker could potentially weaponize it to target users who are already providing consent, leading to significant privacy and security compromises across the affected WordPress installation.

Recommendation

1. Upgrade the WPConsent plugin to the latest version immediately to remediate the insufficient sanitization of comment content.
2. Disable the "Script Blocking" feature within the WPConsent plugin settings until a patch is applied if immediate updating is not possible.
3. Monitor web server access logs for anomalous requests containing the wpconsent_debug=1 parameter, as this is a precursor for the attack chain.
4. Review comment moderation logs for suspicious activity, particularly multiple coordinated comments from the same source.