{
 "id": "WPSEC-2026-2848",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2848/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2848/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2848/index.md",
 "title": "Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.4.0 - Unauthenticated Stored Cross-Site Scripting via Forged Content Blocker Markers in Comments",
 "description": "The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via forged content blocker markers in comments in all versions up to, and including, 5.4.0. This is due to the content blocker's page-wide regular expressions, which strip its internal marker attributes (the 'consent-attribute-invisible-' and 'hcb-fetch-image-from' attributes) from the output. They also match look-alike text in user-supplied markup, so removing it can break the attribute quoting of allowed comment HTML. This makes it possible for unauthenticated attackers who can post comments to inject arbitrary web scripts in pages that will execute whenever a user accesses an affected page.",
 "plugin": {
  "slug": "real-cookie-banner",
  "name": "Real Cookie Banner: GDPR & ePrivacy Cookie Consent",
  "full_name": "Real Cookie Banner: GDPR & ePrivacy Cookie Consent",
  "wordpress_org": "https://wordpress.org/plugins/real-cookie-banner/",
  "advisories_url": "https://wpsec.com/vuln/plugin/real-cookie-banner/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/real-cookie-banner"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.2,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.4.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.4.3"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.4.3",
 "remediation": "Update to 5.4.3 or later.",
 "fix_released": "2026-11-11T09:43:41+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:04:27.356261+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2848/",
  "https://plugins.svn.wordpress.org/real-cookie-banner/tags/5.4.3/",
  "https://wordpress.org/plugins/real-cookie-banner/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/real-cookie-banner",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-12"
 }
}