CVE-2026-85130

Name of the Vulnerable Software and Affected Versions WPLP Cookie Consent versions prior to 4.4.4

Description In multisite installations, the plugin fails to escape a value submitted through a public endpoint before it is output within a JavaScript context on an administrative screen. This allows unauthenticated users to execute arbitrary JavaScript in the session of an administrator who interacts with the logged entry. This is a stored Cross-Site Scripting (XSS) issue, where malicious scripts are permanently stored on the server and executed in the victim's browser.

Recommendations Update WPLP Cookie Consent to version 4.4.4 or later.