CVE-2026-0914 is a stored cross-site scripting vulnerability in the WP DSGVO Tools (GDPR) WordPress plugin affecting all versions up to 3.1.36. The issue stems from improper neutralization of input in the 'lw_content_block' shortcode, where user-supplied attributes are not properly sanitized or escaped. Authenticated attackers with contributor-level permissions or higher can exploit this to inject arbitrary JavaScript code that executes in the context of users viewing the compromised pages. This can lead to limited confidentiality and integrity impacts but does not affect availability. The vulnerability is tracked under CWE-79 and has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable shortcode. When other users access these pages, the injected scripts execute in their browsers, potentially leading to theft of sensitive information or session tokens (confidentiality impact) and unauthorized modification of displayed content (integrity impact). There is no direct impact on system availability. The vulnerability requires authenticated access, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only. Consider disabling or removing the 'lw_content_block' shortcode if feasible. Monitor plugin updates from legalweb for a security patch addressing this issue.