CookieCode is a WordPress plugin that manages cookie banners. The vulnerability arises from insufficient escaping of user‑controlled input before rendering it in the web page, allowing an attacker to inject arbitrary script code. An attacker could embed malicious JavaScript in the plugin’s configuration or the cookie banner content, which would be stored in the database and executed whenever a user visits the WordPress site, potentially leading to credential theft, session hijacking, or defacement.

The affected software is the CookieCode WordPress plugin, version 2.4.4 and earlier. Any WordPress site that has installed CookieCode 2.4.4 or an earlier release is vulnerable. The issue was reported to affect all versions from n/a through <= 2.4.4, with no specific exclusions noted.

The CVSS score of 5.9 indicates moderate severity and the EPSS score of <1% suggests that the exploit is currently unlikely to be found in the wild. The vulnerability is not listed in CISA KEV. Attackers can exploit the flaw by submitting crafted input to the plugin’s admin interface, causing stored XSS that is triggered on subsequent page loads. Because the stored data is rendered without proper neutralization, a successful injection could compromise any visitor to the site. The vulnerability is inferred to be exploitable through a web‑facing interface, but no exploit has been observed publicly at this time.