This vulnerability involves improper neutralization of input in the GDPR Info Cookie Notice & Consent Banner for GDPR & CCPA Compliance plugin, leading to stored cross-site scripting (XSS). It affects all versions up to and including 1.7.11. The issue allows an attacker with some privileges and user interaction to inject malicious scripts that are stored and later executed in the context of the affected web application. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required, user interaction required, and scope change with limited impact on confidentiality, integrity, and availability.

Successful exploitation can lead to execution of arbitrary scripts in users' browsers, potentially allowing theft of user credentials, session tokens, or performing actions on behalf of the user within the affected application context. The impact is rated medium with limited confidentiality, integrity, and availability impacts as per the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, users should consider restricting privileges and user input where possible to reduce risk. Monitor vendor communications for updates regarding a fix.