The WPLP Cookie Consent plugin for WordPress versions prior to 4.4.4 does not properly escape user-supplied input submitted through a public endpoint. This input is later rendered in a JavaScript context on an administrative screen without adequate sanitization, enabling unauthenticated attackers to execute arbitrary JavaScript code in the context of an administrator's session. This vulnerability is limited to multisite WordPress installations using the affected plugin versions.

An attacker can execute arbitrary JavaScript in the browser session of an administrator who views the affected administrative screen. This could lead to session hijacking, privilege escalation, or other malicious actions performed with administrator privileges. The vulnerability requires the attacker to submit crafted input to a public endpoint and rely on an administrator to interact with the logged entry.

Upgrade the WPLP Cookie Consent plugin to version 4.4.4 or later, where this vulnerability is fixed. Until the upgrade, administrators should be cautious when interacting with logged entries originating from untrusted sources, especially in multisite environments. No official patch link was provided, but the version 4.4.4 is indicated as the fixed release.