The vulnerability in Nikel's Beautiful Cookie Consent Banner plugin arises from improper neutralization of user input during web page rendering. This reflected XSS flaw allows attackers to inject arbitrary client‑side scripts that execute within the victim’s browser. Attackers could steal session cookies, perform man‑in‑the‑middle attacks, or deface the site, compromising confidentiality, integrity, and availability of user data.

All versions of the plugin up through 4.6.1 are affected, with no release after that addressing the flaw. The product is a WordPress plugin distributed by the vendor Nikel. Site administrators deploying the plugin should adjust the version matching to avoid vulnerable builds.

The CVSS score is 7.1, indicating high severity. The EPSS score of less than 1% suggests the probability of successful exploitation is low at present, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is web‑based and remote, requiring a victim to visit a maliciously crafted URL or input field managed by the plugin; no authentication is required.