The WP GDPR Cookie Consent plugin for WordPress is vulnerable to a stored cross‑site scripting flaw that is triggered by the 'ninja_gdpr_ajax_actions' AJAX endpoint. The lack of capability and nonce checks on the handleAjaxCalls() method, along with unescaped gdprConfig values that are injected into a <style> block via generateCSS(), allows an attacker who is logged in with subscriber or higher privileges to store malicious JavaScript that will execute whenever any visitor loads a page on the site. This flaw is identified as CWE‑79 and can lead to theft of user session cookies, defacement, or further compromise of the WordPress site.

The vulnerability affects the WP GDPR Cookie Consent plugin developed by techjewel, offering WordPress GDPR cookie consent functionality. All releases up to and including version 1.0.0 are impacted. No later releases are listed in the known affected range, implying that the issue is fixed in 1.0.1 or newer, though vendors should confirm.

The CVSS score of 6.4 indicates a medium severity risk, and the EPSS score is unavailable, so there is no quantifiable estimate of current attack frequency. The flaw is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. Attackers must be authenticated with at least subscriber-level access and must provoke the vulnerable AJAX call. Once a payload is stored, it will be delivered implicitly to all users who visit the affected pages, making the engagement highly visible to site visitors but limited to sites where the vulnerable plugin is installed.