CVE-2026-97640: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in smub WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice)

CVE-2026-97640 is a stored cross-site scripting vulnerability in the WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance plugin for WordPress. It affects all versions up to and including 1.1.9. The flaw arises from improper neutralization of input during web page generation, specifically via comment content processed by the Simple HTML DOM Parser Noise-Key Restoration (mXSS) mechanism. An unauthenticated attacker can exploit this by submitting two coordinated comments: one embedding event-handler syntax inside an allowed <code> element and another placing a deterministic restoration key inside an allowed <abbr title=""> attribute. The key offset can be confirmed via an unauthenticated wpconsent_debug=1 request. This enables injection and execution of arbitrary web scripts in pages viewed by users, without requiring user interaction or privileges.

An unauthenticated attacker can inject and execute arbitrary JavaScript in the context of the affected site, potentially leading to user session hijacking, defacement, or other malicious actions impacting confidentiality and integrity. The vulnerability has a CVSS 3.1 score of 7.2 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and scope change. There is no indication of active exploitation in the wild.

No official patch or fix is currently documented. Users should monitor the vendor's advisory for updates. Until a fix is available, consider disabling the Script Blocking feature to reduce exposure. Avoid enabling unauthenticated debug endpoints such as wpconsent_debug=1. Review and sanitize user-submitted comments carefully or disable comments if feasible.