The vulnerability arises from insufficient sanitization of the 'wpl_user_preference' parameter, causing stored XSS. An attacker can inject arbitrary scripts that persist in the consent logs and execute whenever a visitor loads a page that renders those logs. This can lead to defacement, phishing, cookie theft, session hijacking, or other downstream attacks when a victim executes the injected script.

WordPress sites that install the WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode plugin. All plugin versions up to and including 4.4.1 are vulnerable. Any user who accesses pages containing consent logs on these sites can be exposed.

The CVSS score of 7.2 reflects a high severity risk. The exploit requires web access to the unauthorized AJAX endpoint whose nonce is publicly available through wp_localize_script, so no authentication is needed. While EPSS data is not available, the broad usage of the plugin and the ease of exploiting the public endpoint indicate a realistic exploitation risk. The vulnerability is not listed in CISA KEV, but its impact remains significant.