Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.4.0 - Unauthenticated Stored Cross-Site Scripting via Forged Content Blocker Markers in Comments
- ID
- WPSEC-2026-2848
- Plugin
- Real Cookie Banner: GDPR & ePrivacy Cookie Consent (real-cookie-banner)
- Affected
- all versions before 5.4.3
- Remediation
- Update to 5.4.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-12
- Attack surface
- Real Cookie Banner: GDPR & ePrivacy Cookie Consent on WPSec AttackSurface
- Fix released
- Published
Description
The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via forged content blocker markers in comments in all versions up to, and including, 5.4.0. This is due to the content blocker's page-wide regular expressions, which strip its internal marker attributes (the 'consent-attribute-invisible-' and 'hcb-fetch-image-from' attributes) from the output. They also match look-alike text in user-supplied markup, so removing it can break the attribute quoting of allowed comment HTML. This makes it possible for unauthenticated attackers who can post comments to inject arbitrary web scripts in pages that will execute whenever a user accesses an affected page.
References
- https://wpsec.com/vuln/WPSEC-2026-2848/
- https://plugins.svn.wordpress.org/real-cookie-banner/tags/5.4.3/
- https://wordpress.org/plugins/real-cookie-banner/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS