CVE-2026-8977 is a stored cross-site scripting vulnerability in the WP GDPR Cookie Consent plugin for WordPress (versions <=1.0.0). The vulnerability stems from the handleAjaxCalls() function lacking proper capability and nonce verification, allowing authenticated users to submit malicious input via the 'ninja_gdpr_ajax_actions' AJAX action. Additionally, the gdprConfig values are not properly sanitized, and the generateCSS() function outputs these values directly into a <style> block in wp_head without escaping, enabling script injection that executes in the context of any user visiting the affected page.

An attacker with subscriber-level or higher privileges can inject arbitrary web scripts that execute in the browsers of users viewing the affected pages. This can lead to theft of user credentials, session hijacking, or other malicious actions performed in the context of the victim's session. The vulnerability does not impact availability but compromises confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict plugin usage to trusted users only and consider disabling or removing the plugin if possible. Monitor for updates from the vendor and apply any released patches promptly.