CVE-2026-14989

CVE-2026-14989 is a stored cross-site scripting (XSS) vulnerability in the 'Cookie Banner for GDPR / CCPA - WPLP Cookie Consent' WordPress plugin, caused by insufficient input sanitization and output escaping of the 'wpl_user_preference' parameter. Because the consent-logging AJAX endpoint is registered for unauthenticated users and its required nonce (wpl_consent_logging_nonce) is publicly emitted in frontend pages via wp_localize_script, any unauthenticated site visitor can retrieve the nonce and submit a crafted request that stores arbitrary web script on the site. The injected script then executes in the browser of any user who loads the affected page, letting the attacker run actions in the context of those users (potentially including logged-in privileged users), inject malicious content, or redirect visitors; the CVSS 3.1 score is 7.2 (high) with low confidentiality and integrity impacts, no availability impact, and a changed scope reflecting cross-user execution. Any WordPress site running the plugin at version 4.4.1 or earlier is affected. There is currently no public proof-of-concept, the flaw is not listed in CISA KEV, and no confirmed exploitation is known.

What to do: Update WPLP Cookie Consent to the latest patched release (anything newer than 4.4.1) as soon as it is available, or temporarily deactivate the plugin until patched. Because payloads can be planted by completely unauthenticated visitors, site owners should review stored consent/preference records for injected scripts and check web logs for unexpected unauthenticated requests to the consent-logging AJAX endpoint.