CVE-2026-97640

Name of the Vulnerable Software and Affected Versions WPConsent versions prior to 1.2.0

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS) via comment content. This occurs through a mutation XSS (mXSS) technique involving Simple HTML DOM Parser Noise-Key Restoration. The attack requires the Script Blocking feature to be enabled and involves submitting two coordinated comments: one containing event-handler syntax within a <code> element and another containing a deterministic noise restoration key within an <abbr title=""> attribute. The key offset can be verified using an unauthenticated request to the wpconsent debug=1 parameter. This allows the injection of arbitrary web scripts that execute when a user visits the affected page.

Recommendations Update to a version newer than 1.1.9. Disable the Script Blocking feature as a temporary mitigation measure.