This vulnerability is an improper neutralization of input during web page generation that allows stored Cross‑Site Scripting (XSS). An attacker can inject malicious scripts that run in a visitor’s browser when the affected WordPress plugin renders content. The flaw is identified as CWE‑79 and involves stored user input that is later displayed without proper sanitization.

The WordPress plugin "Cookie Notice & Consent" by christophrado is affected in all versions up to and including 1.6.4; later releases are not impacted.

The CVSS score of 7.1 indicates a high severity, while the EPSS score of less than 1% implies a low current exploitation probability. The flaw is not listed in the CISA KEV catalog. Attackers can exploit it by submitting malicious content through the plugin’s configuration or administrative interface, which is then stored and rendered to site visitors without requiring privileged access.