CVE-2026-92977 is a stored cross-site scripting vulnerability in the Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress, affecting all versions up to and including 5.3.5. The vulnerability is due to improper neutralization of input during web page generation (CWE-79). Attackers can inject arbitrary web scripts via comments, specifically by placing malicious payloads in the title attribute of anchor tags. These payloads bypass WordPress's kses filter at save time and become executable when the plugin's page-wide regex strips the closing quote delimiter during rendering. The attack requires the comment to be approved and publicly displayed, making the standard comment moderation workflow a factor in exploitability.

An unauthenticated attacker can inject persistent malicious scripts into comments that execute in the context of users viewing the affected pages. This can lead to information disclosure and integrity impacts as indicated by the CVSS vector (Confidentiality and Integrity impacts are low, no availability impact). The vulnerability can be exploited remotely without user interaction, increasing risk.

No official patch or fix is currently documented in the provided data. Users should monitor the vendor advisory for updates and apply any forthcoming official fixes promptly. Until a fix is available, carefully moderating comments to prevent malicious payloads from being published can reduce risk. Avoid publishing untrusted comments and consider disabling comments if feasible.