CVE-2026-13360 is a stored cross-site scripting vulnerability in the WPLP Cookie Consent – Cookie Banner & Consent Management plugin for WordPress. The flaw is due to improper neutralization of input during web page generation via the 'regionArray' parameter in versions up to and including 4.3.5. This allows unauthenticated attackers to inject arbitrary scripts that execute when users access the affected pages. Successful exploitation depends on the site administrator enabling the 'Support Google Consent Mode (GCM)' setting, which is off by default. Additionally, the AJAX handler responsible for updating this setting does not perform nonce or capability checks, enabling any authenticated user, even with minimal privileges, to modify the setting and trigger the vulnerability.

The vulnerability allows attackers to inject and execute arbitrary web scripts in the context of the affected site, potentially leading to data theft, session hijacking, or other malicious actions. The impact is limited by the requirement that the 'Support Google Consent Mode (GCM)' setting be enabled. The lack of proper authorization checks in the AJAX handler increases the risk by allowing low-privileged authenticated users to enable this setting and exploit the vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should ensure the 'Support Google Consent Mode (GCM)' setting remains disabled (default) to prevent exploitation. Additionally, restrict authenticated user roles to trusted users only, as Subscriber-level users can exploit the AJAX handler to enable the vulnerable setting.