The Cookie Notice & Consent plugin for WordPress suffers from a stored XSS vulnerability due to improper neutralization of script-related HTML tags (CWE-80) in the uuid parameter. This allows attackers to inject malicious scripts that persist and execute in the context of users visiting the affected pages. The vulnerability affects all versions up to 1.6.5. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity with scope change. No patch or official fix has been documented as of the published date.

Successful exploitation enables an unauthenticated attacker to execute arbitrary JavaScript in the context of users visiting the vulnerable site. This can lead to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality and integrity. Availability is not affected. The vulnerability affects all users who access pages where the malicious payload is stored and rendered.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the Cookie Notice & Consent plugin or applying manual input sanitization and output escaping controls if feasible. Monitoring for suspicious input in the uuid parameter and restricting access to plugin configuration may reduce risk temporarily.