WPConsent’s Simple HTML DOM Parser fails to properly sanitize comment content. An unauthenticated user can submit two coordinated comments—one embedding an event‑handler inside an allowed <code> element and another placing a deterministic noise‑restoration key inside an <abbr title=> attribute—while the Script Blocking feature is enabled. This allows the attacker to inject arbitrary JavaScript that is stored and served to every visitor. The resulting stored cross‑site scripting can compromise user sessions, steal credentials, or modify the site’s content, representing a serious integrity threat.

All installations of the WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance plugin for WordPress, including every version from its inception through 1.1.9, are affected. WordPress sites that use this plugin and have the Script Blocking option turned on are vulnerable.

The CVSS base score of 7.2 denotes a high impact vulnerability. The EPSS score of < 1% indicates a very low probability of exploitation, and the issue is not listed in CISA’s KEV catalog; the attack can be performed without authentication by submitting the crafted comments. The requirement for the Script Blocking feature does limit the attack surface, but many sites enable it to meet EU/US compliance, making exploitation plausible for motivated attackers who can target vulnerable comment forms.