CVE-2026-8977 is a stored cross-site scripting vulnerability in the WP GDPR Cookie Consent plugin for WordPress. The issue arises from the 'ninja_gdpr_ajax_actions' AJAX action lacking proper capability and nonce verification in the handleAjaxCalls() function. Additionally, gdprConfig values are not properly sanitized, and the generateCSS() function outputs these values directly into a <style> block without escaping. This combination allows authenticated users with subscriber-level privileges or higher to inject malicious scripts that execute in the context of any user visiting the affected pages.

An attacker with subscriber-level or higher access can inject arbitrary JavaScript code into pages rendered by the plugin. This can lead to client-side script execution in other users' browsers, potentially resulting in session hijacking, defacement, or other attacks that leverage XSS. The vulnerability does not affect availability but impacts confidentiality and integrity of user sessions and data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level user capabilities if possible and monitor for suspicious activity related to the plugin. Avoid granting unnecessary privileges to untrusted users. Do not rely on generic mitigations; wait for vendor-provided updates.