The vulnerability in the Cookie consent for developers WordPress plugin allows stored cross‑site scripting via several configuration fields. The plugin fails to sanitize input or escape output, causing any user‑submitted value entered by an administrator to be saved and later rendered in the site's pages. Once injected, the malicious scripts execute in the browser of any visitor to the affected pages, enabling data theft, session hijacking, or defacement.

All installations of the plugin with versions up to and including 1.7.1 on WordPress multi‑site setups where the unfiltered_html capability has been disabled. The flaw is specific to these environments and does not affect single‑site installs or installations where unfiltered_html is enabled.

The CVSS base score of 4.4 indicates a moderate severity, and the EPSS score of less than 1% suggests very limited likelihood of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attack execution requires an authenticated user with administrative privileges; once the script is stored it will affect all site visitors, raising the potential impact from a single administrative account to all users. Although currently low probability, the presence of stored XSS remains a significant risk to site integrity and user privacy.