A reflected cross‑site scripting flaw in WP Legal Pages’ WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin allows a subscriber to inject arbitrary JavaScript into the web page, potentially hijacking users' sessions, defacing content or exfiltrating data when other site visitors interact with the plugin’s messages.

Any WordPress site that has installed WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions 4.3.9 or earlier, specifically the product from WP Legal Pages, is vulnerable.

The CVSS score of 6.5 indicates moderate severity; the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The flaw is a subscriber‑initiated XSS, meaning an attacker would need to create malicious content through the subscriber interface, which is then rendered in the browser of any user who views that content. Exploitation would affect confidentiality and integrity of impacted users, but availability is not directly impacted. Without evidence of active exploitation, the risk is moderate, but sites should treat it as a medium‑priority issue and patch promptly.