The WPLP Cookie Consent plugin for WordPress contains a stored XSS flaw that originates from the "regionArray" parameter. Unsanitized input is saved by the AJAX handler and later rendered without escaping, allowing an attacker to embed arbitrary scripts that execute when a user views a page containing the injected content. The flaw is exploitable when the "Support Google Consent Mode (GCM)" option is activated, a setting that is disabled by default. Unlike typical XSS bugs, this one can be triggered by any authenticated user, since the handler performs no nonce or capability checks and permits even Subscriber‑level accounts to overwrite the plugin setting.

WordPress sites that have installed the WPLP Cookie Consent (Cookie Banner for GDPR/CCPA) plugin, versions up to and including 4.3.5, and have enabled the GCM setting. Administrators of those sites are the primary users, but any user with Subscriber privileges can perform the injection.

The CVSS score of 7.2 indicates a high severity due to the stored nature of the attack and the potential for affecting all page visitors. The EPSS score is not available and the issue is not yet listed in the CISA KEV catalog, suggesting exploitation is not widespread yet. However, once a user is authenticated with a role equal to or higher than Subscriber, they can submit the malicious payload without restriction, making the vulnerability easy to abuse within a compromised or legitimately logged‑in account. The risk is therefore moderate to high, especially on sites where GCM is enabled and the Subscriber role has default editing capabilities.