# GDPR Cookie Consent & Compliance Notice <= 3.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Cookie Category Scripts

- **ID:** WPSEC-2026-1824
- **Plugin:** CookieYes – Cookie Banner for Cookie Consent (Easy to setup GDPR/CCPA Compliant Cookie Notice) (`cookie-law-info`), https://wordpress.org/plugins/cookie-law-info/
- **Affected versions:** from 2.0.0 before 3.5.8
- **Fixed in:** 3.5.8 (Update to 3.5.8 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-28)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/cookie-law-info
- **Fix released:** 2026-10-27
- **Published:** 2026-10-28
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1824/

## Description

The Cookie Banner for Cookie Consent (Easy to setup GDPR/CCPA Compliant Cookie Notice) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the cookie category head and body scripts in all versions up to, and including, 3.5.7. This happens because the cookielawinfo-category taxonomy relies on WordPress's default term capabilities, the plugin has no capability, nonce or unfiltered_html check when it saves category scripts on term creation and edit, and the stored scripts are output unescaped inside the admin term edit form's textarea. This makes it possible for authenticated attackers, with contributor-level access and above, to create cookie categories (for example by assigning a new term through a post's tax_input) that carry arbitrary web scripts. Those scripts are printed on front-end pages and in the administrator's term edit screen. In 3.0.0 and later, only sites still running the plugin's legacy mode (settings carried over from 2.x and never migrated to the 3.0 interface) are affected.

## References

- https://wpsec.com/vuln/WPSEC-2026-1824/
- https://plugins.svn.wordpress.org/cookie-law-info/tags/3.5.8/
- https://wordpress.org/plugins/cookie-law-info/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1824/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.