Unauthenticated Cross Site Scripting (XSS) allows a threat actor to inject arbitrary JavaScript into pages served by the affected WordPress plugin. This flaw can result in the execution of malicious code within the browser context of any visitor who views the compromised page, potentially compromising session data, defacing content, or redirecting users to phishing sites. The vulnerability is driven by unsanitised user-controlled input as defined by CWE-79.

The issue affects the WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin distributed by WP Legal Pages, versions 4.4.6 and earlier. Any WordPress installation using these plugin versions is susceptible.

The current CVSS score is 7.1, indicating high severity. The EPSS score is 0.00251, indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw without authentication by crafting a malicious link or embedding a script in a parameter that the plugin echoes back in the page. Once executed, the script runs with the privileges of the site visitor, enabling data theft, session hijacking, or further compromise.