CVE-2026-97640

7.2High

Published 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.2High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-79

Impact

Unauthenticated attackers can execute arbitrary JavaScript in users' browsers by submitting paired malicious WordPress comments. Successful exploitation requires the plugin's Script Blocking feature to be active.

Root cause

The Simple HTML DOM Parser's deterministic noise-key restoration mechanism fails to properly sanitize comment HTML, enabling mutation XSS (mXSS).

Affected systems

WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance plugin for WordPress up to, and including, 1.1.9

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Fix & remediation

Upgrade the WPConsent plugin to a version newer than 1.1.9. If patching immediately is not possible, disable the Script Blocking feature in the plugin settings.

shell

$ wp plugin update wpconsent-cookies-banner-privacy-suite

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

The WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS) in all versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the Script Blocking feature to be enabled, and the exploit chain depends on an attacker submitting two coordinated comments — one embedding event-handler syntax inside an allowed <code> element and one placing the deterministic ___noise___ restoration key inside an allowed <abbr title=""> attribute — with the key offset confirmable via an unauthenticated wpconsent_debug=1 request.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-97640