{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/wpconsent--cookie-banner--cookie-consent-for-privacy-compliance--1.1.9/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wpconsent:cookie_banner_\u0026_cookie_consent_for_privacy_compliance:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-97640"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["WPConsent – Cookie Banner \u0026 Cookie Consent for Privacy Compliance (\u003c= 1.1.9)"],"_cs_severities":["high"],"_cs_tags":["xss","wordpress","web-application","cms"],"_cs_type":"advisory","_cs_vendors":["WPConsent"],"content_html":"\u003cp\u003eThe WPConsent - Cookie Banner \u0026amp; Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to, and including, 1.1.9. The vulnerability arises due to insufficient input sanitization and output escaping when the \u0026quot;Script Blocking\u0026quot; feature is active. An unauthenticated attacker can exploit this via mutation XSS (mXSS), specifically by leveraging the plugin's Simple HTML DOM Parser to manipulate how content is rendered. This flaw allows an attacker to inject arbitrary web scripts into WordPress pages, which then execute when an unsuspecting user visits the affected page. The exploit requires chaining two specific comment submissions and using a debug parameter to verify injection offsets, posing a significant risk to site administrators and users.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker enables or identifies a target WordPress site using the vulnerable WPConsent plugin with the \u0026quot;Script Blocking\u0026quot; feature enabled.\u003c/li\u003e\n\u003cli\u003eAttacker performs an unauthenticated request to the site with the parameter \u003ccode\u003ewpconsent_debug=1\u003c/code\u003e to retrieve the deterministic \u003ccode\u003e___noise___\u003c/code\u003e restoration key and determine the current injection offset.\u003c/li\u003e\n\u003cli\u003eAttacker submits the first comment containing malicious event-handler syntax (e.g., \u003ccode\u003eonmouseover\u003c/code\u003e) embedded inside a permitted \u003ccode\u003e\u0026lt;code\u0026gt;\u003c/code\u003e HTML element.\u003c/li\u003e\n\u003cli\u003eAttacker submits a second, coordinated comment containing the required \u003ccode\u003e___noise___\u003c/code\u003e restoration key placed within an allowed \u003ccode\u003e\u0026lt;abbr title=\u0026quot;\u0026quot;\u0026gt;\u003c/code\u003e attribute.\u003c/li\u003e\n\u003cli\u003eThe plugin's Simple HTML DOM Parser processes these comments, causing the stored payloads to mutate and break out of the intended HTML tag structure.\u003c/li\u003e\n\u003cli\u003eThe injected script is successfully stored on the server side as part of the comment section of a post or page.\u003c/li\u003e\n\u003cli\u003eA legitimate user or administrator visits the page containing the malicious comments.\u003c/li\u003e\n\u003cli\u003eThe browser renders the mutated HTML, triggering the execution of the attacker's script in the context of the user's browser session.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of a victim's browser session. This can lead to the theft of session cookies, administrative account takeover, unauthorized modification of site content, or the redirection of users to malicious external domains. As this plugin is designed for privacy compliance, an attacker could potentially weaponize it to target users who are already providing consent, leading to significant privacy and security compromises across the affected WordPress installation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade the WPConsent plugin to the latest version immediately to remediate the insufficient sanitization of comment content.\u003c/li\u003e\n\u003cli\u003eDisable the \u0026quot;Script Blocking\u0026quot; feature within the WPConsent plugin settings until a patch is applied if immediate updating is not possible.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for anomalous requests containing the \u003ccode\u003ewpconsent_debug=1\u003c/code\u003e parameter, as this is a precursor for the attack chain.\u003c/li\u003e\n\u003cli\u003eReview comment moderation logs for suspicious activity, particularly multiple coordinated comments from the same source.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-16T08:25:56Z","date_published":"2026-10-16T08:25:56Z","id":"https://feed.craftedsignal.io/briefs/2026-10-wpconsent-xss/","summary":"The WPConsent WordPress plugin up to version 1.1.9 is vulnerable to stored Cross-Site Scripting (XSS) via mXSS, allowing unauthenticated attackers to execute arbitrary scripts in a user's browser session.","title":"Stored Cross-Site Scripting in WPConsent WordPress Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-wpconsent-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - WPConsent – Cookie Banner \u0026 Cookie Consent for Privacy Compliance (\u003c= 1.1.9)","version":"https://jsonfeed.org/version/1.1"}