The WPLP Cookie Consent plugin for WordPress suffers from a stored XSS vulnerability via the 'wpl_user_preference' parameter in versions up to 4.4.1. Due to improper neutralization of input, attackers can inject malicious scripts that persist and execute in users' browsers. The consent-logging AJAX endpoint is registered for unauthenticated users and its nonce is publicly available via wp_localize_script, allowing unauthenticated attackers to exploit the vulnerability without needing privileged access or authentication.

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of the affected site for any user visiting the injected page. This can lead to theft of sensitive information, session hijacking, or other malicious actions limited to the scope of the browser session. The vulnerability does not impact availability but compromises confidentiality and integrity of user interactions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected plugin or disable it if possible. Monitor official vendor channels for updates and apply patches promptly once released.