This vulnerability (CVE-2026-73359) is classified as CWE-79, indicating improper neutralization of input leading to cross-site scripting (XSS). It affects the WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin for WordPress, specifically versions up to and including 4.3.9. The issue allows a subscriber-level user to inject malicious scripts into web pages generated by the plugin. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, requiring privileges at the level of a subscriber, and user interaction. The impact includes partial confidentiality, integrity, and availability loss. No patch or official remediation level is currently documented, and no known active exploitation has been reported.

Successful exploitation could allow an attacker with subscriber privileges to execute arbitrary scripts in the context of the affected website, potentially leading to partial loss of confidentiality, integrity, and availability. This could result in unauthorized actions or data exposure within the scope of the affected web application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting subscriber input capabilities or applying temporary input sanitization measures if feasible.