# Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.4.0 - Unauthenticated Stored Cross-Site Scripting via Forged Content Blocker Markers in Comments

- **ID:** WPSEC-2026-2848
- **Plugin:** Real Cookie Banner: GDPR & ePrivacy Cookie Consent (`real-cookie-banner`), https://wordpress.org/plugins/real-cookie-banner/
- **Affected versions:** all versions before 5.4.3
- **Fixed in:** 5.4.3 (Update to 5.4.3 or later.)
- **Severity:** High 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/real-cookie-banner
- **Fix released:** 2026-11-11
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2848/

## Description

The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via forged content blocker markers in comments in all versions up to, and including, 5.4.0. This is due to the content blocker's page-wide regular expressions, which strip its internal marker attributes (the 'consent-attribute-invisible-' and 'hcb-fetch-image-from' attributes) from the output. They also match look-alike text in user-supplied markup, so removing it can break the attribute quoting of allowed comment HTML. This makes it possible for unauthenticated attackers who can post comments to inject arbitrary web scripts in pages that will execute whenever a user accesses an affected page.

## References

- https://wpsec.com/vuln/WPSEC-2026-2848/
- https://plugins.svn.wordpress.org/real-cookie-banner/tags/5.4.3/
- https://wordpress.org/plugins/real-cookie-banner/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2848/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.