GDPR Cookie Consent & Compliance Notice <= 3.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Cookie Category Scripts
- ID
- WPSEC-2026-1824
- Plugin
- CookieYes – Cookie Banner for Cookie Consent (Easy to setup GDPR/CCPA Compliant Cookie Notice) (cookie-law-info)
- Affected
- from 2.0.0 before 3.5.8
- Remediation
- Update to 3.5.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-28
- Attack surface
- GDPR Cookie Consent & Compliance Notice on WPSec AttackSurface
- Fix released
- Published
Description
The Cookie Banner for Cookie Consent (Easy to setup GDPR/CCPA Compliant Cookie Notice) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the cookie category head and body scripts in all versions up to, and including, 3.5.7. This happens because the cookielawinfo-category taxonomy relies on WordPress's default term capabilities, the plugin has no capability, nonce or unfiltered_html check when it saves category scripts on term creation and edit, and the stored scripts are output unescaped inside the admin term edit form's textarea. This makes it possible for authenticated attackers, with contributor-level access and above, to create cookie categories (for example by assigning a new term through a post's tax_input) that carry arbitrary web scripts. Those scripts are printed on front-end pages and in the administrator's term edit screen. In 3.0.0 and later, only sites still running the plugin's legacy mode (settings carried over from 2.x and never migrated to the 3.0 interface) are affected.
References
- https://wpsec.com/vuln/WPSEC-2026-1824/
- https://plugins.svn.wordpress.org/cookie-law-info/tags/3.5.8/
- https://wordpress.org/plugins/cookie-law-info/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS