This vulnerability is an improper neutralization of input during web page generation, allowing an attacker to store malicious scripts in the Cookie Warning plugin. The stored XSS can execute arbitrary JavaScript in the browsers of any user who views a page where the plugin displays content. The flaw stems from a lack of proper output encoding, classified as CWE‑79. The impact includes theft of session cookies, credential hijacking, or other client‑side attacks.

The issue affects the WordPress Cookie Warning plugin, version 1.3 and earlier, released by the vendor Dourou. Any site running the plugin in those versions is vulnerable unless the plugin has been removed or updated.

The CVSS score is 7.5, indicating a high severity and sufficient impact to warrant a prompt response. The EPSS score of less than 1% suggests that currently the likelihood of exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the stored nature of the XSS means anyone who can submit data to the plugin can potentially compromise users, and the attack path is straightforward once the plugin accepts unsanitized input. The primary attack vector is inferred to be remote via a web‑based interface that accepts user input, such as an admin form or a public‑facing page that the plugin processes.