PT-2026-47683 · WordPress · Gdpr Cookie Consent

Hardik Patel + 1 · Published 2026-06-09 · Updated 2026-06-09 · CVE-2026-8977

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP GDPR Cookie Consent versions prior to 1.0.1

Description The plugin is subject to Stored Cross-Site Scripting. Authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts into pages. This occurs because the handleAjaxCalls() function lacks capability and nonce checks for the 'ninja gdpr ajax actions' AJAX action. Additionally, there is insufficient input sanitization for gdprConfig values and a lack of output escaping in the generateCSS() function, which echoes stored configuration values directly into a style block rendered on the page head.

Recommendations Update to a version later than 1.0.0. As a temporary mitigation, restrict access to the 'ninja gdpr ajax actions' AJAX action or disable the handleAjaxCalls() function.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-8977

Affected Products

Gdpr Cookie Consent

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-8977 · Security Note
• https://plugins.trac.wordpress.org/browser/wp-gdpr-cookie-consent/trunk/Classes/GdprHandler.php#L169 · Note
• https://twitter.com/VulmonFeeds/status/2064226122259186111 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wp-gdpr-cookie-consent/trunk/Classes/GdprHandler.php#L7 · Note
• https://plugins.trac.wordpress.org/browser/wp-gdpr-cookie-consent/trunk/wp-gdpr-cookie-consent.php#L35 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/95c7f999-3676-4b91-9ee0-f55a27bcd93c?source=cve · Note
• https://plugins.trac.wordpress.org/browser/wp-gdpr-cookie-consent/trunk/Classes/GdprHandler.php#L86 · Note