The Cookie Notice & Compliance for GDPR / CCPA WordPress plugin (versions up to 2.5.8) suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input in the cookies_accepted shortcode. Authenticated users with contributor or higher privileges can inject arbitrary JavaScript code that executes in the context of other users viewing the injected page. This vulnerability could lead to limited confidentiality and integrity impacts, such as session hijacking or content manipulation, but does not affect availability. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, and required privileges. No patch or remediation details are currently provided by the vendor.

Successful exploitation allows an authenticated contributor-level or higher user to inject persistent malicious scripts into pages via the cookies_accepted shortcode. These scripts execute in the browsers of users who visit the infected pages, potentially leading to limited confidentiality and integrity impacts such as theft of session tokens or unauthorized actions performed on behalf of users. There is no impact on availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level and higher access to trusted users only. Monitor plugin updates from humanityco for a security patch addressing this vulnerability. Avoid using the vulnerable shortcode or disable the plugin if possible as a temporary mitigation.