The WordPress WP GDPR Cookie Consent plugin contains a CSRF flaw that an attacker can use to submit malicious requests while a user is authenticated. The vulnerability can be leveraged to store a cross‑site scripting payload within the plugin, which would then execute in the context of any visitor to the site. This leads to potential data theft, session hijacking or defacement if the payload is crafted to exploit additional weaknesses.

All installations of the Shahjahan Jewel WP GDPR Cookie Consent plugin up to and including version 1.0.0 are vulnerable. The plugin is distributed as a standard WordPress extension and is used on any WordPress site that has installed it.

With a CVSS score of 7.1 the vulnerability is considered medium‑high. The EPSS score of less than 1% indicates that exploitation is currently unlikely, and it is not listed in the CISA KEV catalog. The likely attack path requires the victim to be logged into the WordPress admin area; an attacker would trick the user into clicking a crafted link or visiting a malicious site that sends a forged request carrying the XSS payload. Once injected, the stored script can run in the context of any site visitor, potentially compromising site integrity and confidentiality.