Description
Cookie Law Bar 1.2.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting unsanitized input to the Bar Message field. Attackers can inject script payloads through the plugin settings page that execute in the browsers of all WordPress users viewing the site, enabling cookie theft and sensitive data exfiltration.
Published: 2026-05-16
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a stored Cross‑Site Scripting flaw in the Cookie Law Bar plugin. The Bar Message field accepts unsanitized input, allowing an attacker who can access the plugin settings to inject scripts. When a malicious script is stored, it executes in the browsers of all WordPress users who view the site, enabling cookie theft, session hijacking, and sensitive data exfiltration.

Affected Systems

The flaw affects the Cookielawinfo Cookie Law Bar WordPress plugin, version 1.2.1, used on any WordPress site that installs this plugin. No other vendors or product versions are listed as impacted.

Risk and Exploitability

The CVSS base score is 5.1, giving the vulnerability a Medium severity rating. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploitation activity. Attackers require authenticated access to the WordPress admin area to inject scripts via the plugin’s settings page, limiting the attack surface to users with sufficient privileges.

Generated by OpenCVE AI on May 16, 2026 at 16:24 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Cookielawinfo Cookie Law Bar plugin to version 1.2.2 or later.
  • If an upgrade is not immediately possible, restrict the plugin settings page to administrators and disable the Bar Message feature from front‑end pages to block script injection.
  • Implement a Content Security Policy that forbids inline scripts, reducing the impact of any remaining stored XSS payload.

Generated by OpenCVE AI on May 16, 2026 at 16:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 18 May 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 17 May 2026 18:00:00 +0000

Type Values Removed Values Added
First Time appeared Cookielawinfo
Cookielawinfo cookie Law Bar
Wordpress
Wordpress wordpress
Vendors & Products Cookielawinfo
Cookielawinfo cookie Law Bar
Wordpress
Wordpress wordpress

Sat, 16 May 2026 15:45:00 +0000

Type Values Removed Values Added
Description Cookie Law Bar 1.2.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting unsanitized input to the Bar Message field. Attackers can inject script payloads through the plugin settings page that execute in the browsers of all WordPress users viewing the site, enabling cookie theft and sensitive data exfiltration.
Title WordPress Plugin Cookie Law Bar 1.2.1 Stored XSS via clb_bar_msg
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}

Subscriptions

Cookielawinfo Cookie Law Bar
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-05-24T01:37:14.399Z

Reserved: 2026-02-01T11:24:18.720Z

Link: CVE-2021-47957

cve-icon Vulnrichment

Updated: 2026-05-18T13:50:58.892Z

cve-icon NVD

Status : Deferred

Published: 2026-05-16T16:16:22.037

Modified: 2026-05-18T17:44:03.697

Link: CVE-2021-47957

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-17T17:00:42Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')