The dcurasi Cookie Notice Bar plugin for WordPress suffers from a stored XSS vulnerability (CWE-79) due to improper neutralization of input during web page generation. Authenticated users with administrator privileges can inject malicious scripts that persist in the plugin's output, affecting multi-site setups or sites with unfiltered_html disabled. The vulnerability allows execution of arbitrary scripts in the context of users visiting the compromised pages. The CVSS 3.1 score is 5.5 (medium severity), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and impact on confidentiality and integrity but not availability. There is no known exploit in the wild and no vendor patch or advisory currently provided.

An attacker with administrator-level access on affected WordPress installations can inject persistent malicious scripts via the Cookie Notice Bar plugin. This can lead to unauthorized script execution in users' browsers, potentially compromising user data confidentiality and integrity. The vulnerability does not impact availability. The scope is limited to multi-site installations or those with unfiltered_html disabled, restricting the affected user base.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and consider disabling or replacing the Cookie Notice Bar plugin in multi-site or unfiltered_html-disabled environments. Monitor official dcurasi or WordPress security advisories for updates.