CVE-2025-10496: Cookie Notice & Consent Plugin XSS Flaw

CVE-2025-10496 Overview

CVE-2025-10496 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Cookie Notice & Consent plugin for WordPress in all versions up to and including 1.6.5. The flaw resides in the handling of the uuid parameter, which the plugin fails to sanitize on input and escape on output. Unauthenticated attackers can inject arbitrary JavaScript that executes in the browser of any user who later loads the affected page. The weakness is classified under CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page.

Critical Impact
Unauthenticated attackers can store malicious JavaScript that executes against site visitors and administrators, enabling session theft, account takeover, and admin-context actions.

Affected Products

Cookie Notice & Consent plugin for WordPress, versions ≤ 1.6.5
WordPress sites with the plugin active and accepting uuid parameter input
All deployments of the plugin prior to the patched release

Discovery Timeline

2025-10-09 - CVE-2025-10496 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-10496

Vulnerability Analysis

The Cookie Notice & Consent plugin processes the uuid parameter through its admin and logger components without applying WordPress sanitization helpers such as sanitize_text_key() or escaping helpers like esc_html() and esc_attr() at output. The vulnerable code paths reside in class-cnc-admin.php and class-cnc-logger.php, where attacker-supplied values are written into log records and later rendered into administrative views. Because the injection point is reachable without authentication, any visitor or automated client can persist payloads.

When an administrator subsequently views the affected page, the unescaped uuid value is rendered into the HTML response. The browser interprets injected <script> tags or event handlers, executing attacker-controlled JavaScript under the site's origin. This grants the attacker access to session cookies, nonces, and the administrative DOM.

Root Cause

The root cause is missing input sanitization combined with absent output escaping for the uuid request parameter. Reference implementations are visible in the plugin's source at class-cnc-admin.php line 33 and class-cnc-logger.php line 141. Stored payloads persist in plugin logs and execute on retrieval.

Attack Vector

Exploitation requires only network access to the WordPress site. An unauthenticated attacker submits a crafted request containing a malicious uuid value, for example a string mixing HTML tags with JavaScript event handlers. The payload is written to plugin storage. When a privileged user opens the rendering page, the script executes with that user's privileges, enabling administrative actions, plugin installation, or pivot to backend code execution. Refer to the Wordfence Vulnerability Report for the upstream technical analysis.

Detection Methods for CVE-2025-10496

Indicators of Compromise

Web server access logs containing requests with uuid parameter values that include <script>, onerror=, onload=, or URL-encoded equivalents (%3Cscript%3E)
Plugin log entries written by class-cnc-logger.php containing HTML or JavaScript syntax in fields expected to hold UUID strings
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after viewing plugin pages
Newly created WordPress administrator accounts or modified user roles without corresponding admin activity

Detection Strategies

Inspect WordPress database tables and plugin log files for uuid values that do not match a canonical UUID regex such as ^[0-9a-f-]{36}$
Deploy Web Application Firewall (WAF) rules to flag requests containing script tags or JavaScript event handlers in any uuid parameter
Monitor for the file path /wp-content/plugins/cookie-notice-consent/ in request URIs combined with suspicious payload signatures

Monitoring Recommendations

Enable verbose access logging on WordPress front-end endpoints and ship logs to a centralized SIEM for retention and correlation
Alert on administrator session anomalies, including new IPs, user-agent shifts, or off-hours admin activity following plugin page views
Track plugin version inventory across managed WordPress sites to confirm whether 1.6.5 or earlier remains deployed

How to Mitigate CVE-2025-10496

Immediate Actions Required

Update the Cookie Notice & Consent plugin to the version published in WordPress plugin changeset 3373718, which supersedes 1.6.5
Audit plugin log tables and stored records for injected HTML or JavaScript and purge tainted entries
Rotate WordPress administrator passwords and invalidate active sessions if exploitation is suspected

Patch Information

The vendor addressed CVE-2025-10496 in the release following 1.6.5. The fix applies sanitization to the uuid input and escaping at output sites in class-cnc-admin.php and class-cnc-logger.php. Review the diff via the WordPress Plugin Changeset and apply the latest version through the WordPress admin Plugins screen or WP-CLI.

Workarounds

Deactivate and remove the Cookie Notice & Consent plugin until upgrade is feasible
Configure a WAF rule to block requests where the uuid parameter contains characters outside the hexadecimal and dash UUID character set
Restrict access to the WordPress admin area by IP allowlist to limit administrator exposure to stored payloads

bash

# Example WP-CLI upgrade command
wp plugin update cookie-notice-consent --path=/var/www/html
wp plugin get cookie-notice-consent --field=version