The GDPR Cookie Compliance plugin for WordPress, developed by mooveagency, suffers from a stored XSS vulnerability (CWE-79) in versions up to 4.15.6. Authenticated users with administrator-level permissions can inject arbitrary scripts via the plugin's admin settings due to inadequate sanitization and escaping of input. This vulnerability manifests only in multi-site setups or installations where the unfiltered_html capability is disabled, potentially allowing malicious scripts to execute in the context of users visiting affected pages.

Successful exploitation allows an authenticated administrator to inject persistent malicious scripts that execute in the browsers of users accessing the affected pages. This can lead to information disclosure or session hijacking limited to the scope of the injected scripts. The impact is rated medium with partial confidentiality and integrity loss but no availability impact. The vulnerability does not affect single-site installations or those with unfiltered_html enabled.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and consider disabling multi-site features or enabling unfiltered_html capability if feasible to reduce exposure. Monitor official mooveagency communications for updates regarding patches or mitigations.