The Cookie consent for developers WordPress plugin suffers from a stored XSS vulnerability (CWE-79) due to improper neutralization of input during web page generation. Authenticated administrators can exploit this by injecting malicious scripts into multiple plugin settings fields. These scripts execute in the context of users visiting the injected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to and including 1.7.1, but only in multi-site environments or installations with unfiltered_html disabled. No official patch or remediation details are currently provided.

An attacker with administrator-level access can inject persistent malicious scripts into plugin settings, which execute in the browsers of users viewing the affected pages. This can lead to limited confidentiality and integrity impacts, such as theft of user session data or manipulation of page content. The vulnerability does not affect availability and requires high privileges and specific WordPress configurations (multi-site or unfiltered_html disabled) to be exploitable.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit administrator access to trusted users only and consider disabling or replacing the vulnerable plugin in multi-site or unfiltered_html-disabled environments. Monitor vendor channels for updates and apply patches promptly once released.