The msmitley WP Cookie Consent plugin versions up to 1.0 contain a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This vulnerability could allow an attacker with high privileges and requiring user interaction to inject malicious scripts that execute in the security context of the affected application, potentially leading to limited confidentiality, integrity, and availability impacts. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and a scope change.

Successful exploitation could lead to execution of arbitrary scripts in the context of the affected application, potentially resulting in limited disclosure of information, modification of data, and disruption of service. The impact is limited by the requirement for high privileges and user interaction. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should limit plugin usage to trusted administrators and avoid exposing high-privilege accounts unnecessarily. Monitor vendor channels for updates and apply patches promptly once available.