CVE-2026-14989: WPLP Cookie Consent WordPress XSS Vulnerability

CVE-2026-14989 Overview

CVE-2026-14989 is a stored cross-site scripting (XSS) vulnerability in the Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress. The flaw affects all versions up to and including 4.4.1. The plugin fails to properly sanitize input and escape output for the wpl_user_preference parameter. Unauthenticated attackers can inject arbitrary web scripts that execute when visitors access injected pages. The vulnerability is classified under CWE-79.

Critical Impact
Unauthenticated attackers can plant persistent JavaScript payloads through a public AJAX endpoint whose nonce is exposed on the frontend, enabling session hijacking, credential theft, and administrative account takeover when injected content is rendered.

Affected Products

Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress
All versions up to and including 4.4.1
WordPress sites exposing the wpl_consent_logging AJAX endpoint

Discovery Timeline

2026-09-09 - CVE-2026-14989 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-14989

Vulnerability Analysis

The vulnerability resides in the consent-logging module of the WPLP Cookie Consent plugin. The plugin registers an AJAX endpoint that accepts a wpl_user_preference parameter and persists its value to the consent-log database table. Server-side code neither sanitizes the input on write nor escapes the value on read when rendering the stored data back to page contexts. Attackers can therefore embed HTML and JavaScript that later executes in the browser of any visitor to the affected page.

Root Cause

The root cause is insufficient input sanitization combined with missing output escaping in the consent-logs handler. Relevant code paths appear in class-wpl-consent-logs.php and class-wpl-cookie-consent-consent-logs.php under the public/modules/consent-logs/ directory of the plugin. The stored wpl_user_preference value flows directly into rendered output without passing through esc_html, esc_attr, or wp_kses filtering.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction beyond eventual page rendering. The wpl_consent_logging AJAX action is registered for unauthenticated users through the wp_ajax_nopriv_ hook. Its required nonce, wpl_consent_logging_nonce, is publicly emitted to the frontend via wp_localize_script. Any site visitor can retrieve the nonce from the page source, then submit a crafted POST request to admin-ajax.php containing a malicious wpl_user_preference payload. The stored script executes whenever the injected content is subsequently displayed. See the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-14989

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php with action=wpl_consent_logging containing HTML tags or JavaScript in the wpl_user_preference parameter
Consent-log database rows containing <script>, onerror=, onload=, or javascript: substrings
Unexpected outbound requests from browsers viewing consent-log pages to attacker-controlled domains
Newly created WordPress administrator accounts or unexplained session-cookie exfiltration events

Detection Strategies

Query the plugin's consent-log tables for rows whose stored preference field contains angle brackets, event-handler attributes, or encoded script markers
Inspect web server access logs for high-volume unauthenticated POST activity targeting the wpl_consent_logging action
Compare installed plugin versions against 4.4.1 across the WordPress estate using WP-CLI or plugin inventory tooling

Monitoring Recommendations

Enable web application firewall (WAF) rules that inspect admin-ajax.php POST bodies for XSS payloads targeting the wpl_user_preference parameter
Alert on administrator session creation from previously unseen IP addresses or user agents
Monitor for modifications to WordPress user roles and options tables following visits to pages rendering consent-log content

How to Mitigate CVE-2026-14989

Immediate Actions Required

Update the WPLP Cookie Consent plugin to a version newer than 4.4.1 as soon as a fixed release is available
Audit the plugin's consent-log tables and remove any rows containing script tags or JavaScript event handlers
Rotate WordPress administrator credentials and invalidate active sessions if injected payloads are found
Review recently created users and installed plugins for signs of post-exploitation persistence

Patch Information

A fix is tracked in the plugin's repository. Refer to the WordPress GDPR Consent Changeset and the vulnerable source paths in class-wpl-consent-logs.php and class-wpl-cookie-consent-consent-logs.php to confirm which release incorporates the sanitization and escaping fix before upgrading production sites.

Workarounds

Deactivate and remove the WPLP Cookie Consent plugin until a patched release can be deployed
Deploy WAF signatures that block requests to admin-ajax.php with action=wpl_consent_logging containing markup or scripting characters in wpl_user_preference
Restrict access to consent-log display pages to authenticated administrators through server-side access controls

bash

# Configuration example
# Example ModSecurity rule to block XSS payloads targeting the vulnerable AJAX action
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1026149890,msg:'CVE-2026-14989 WPLP Cookie Consent XSS attempt'"
  SecRule ARGS:action "@streq wpl_consent_logging" \
    "chain"
    SecRule ARGS:wpl_user_preference "@rx (?i)(<script|onerror=|onload=|javascript:)" \
      "t:none,t:urlDecodeUni"