CVE-2026-13360 is a stored cross-site scripting vulnerability in the WPLP Cookie Consent – Cookie Banner & Consent Management plugin for WordPress. The flaw exists in all versions up to 4.3.5 due to improper neutralization of input in the 'regionArray' parameter. An attacker can inject arbitrary scripts that execute when users access the affected pages. Successful exploitation depends on the 'Support Google Consent Mode (GCM)' feature being enabled. Additionally, the AJAX handler responsible for updating this setting does not perform nonce or capability checks, allowing low-privileged authenticated users to overwrite the setting and potentially facilitate exploitation.

An attacker can inject persistent malicious scripts into web pages viewed by users, leading to potential theft of user data or session hijacking. The vulnerability requires the GCM setting to be enabled, which is off by default, reducing exposure. However, the lack of proper authorization checks in the AJAX handler allows even low-privileged authenticated users to enable or modify this setting, increasing the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should ensure the 'Support Google Consent Mode (GCM)' setting remains disabled if not required. Restrict authenticated user roles to trusted users only, as low-privileged users can modify plugin settings due to missing authorization checks.