CVE-2026-73359: WP Cookie Notice GDPR Plugin XSS Flaw

CVE-2026-73359 Overview

CVE-2026-73359 is a stored Cross-Site Scripting (XSS) vulnerability in the WP Cookie Notice for GDPR, CCPA & ePrivacy Consent WordPress plugin. The flaw affects versions 4.3.9 and earlier of the gdpr-cookie-consent plugin. Authenticated users with Subscriber-level privileges can inject malicious JavaScript that executes in the browsers of other users, including administrators. The vulnerability maps to [CWE-79], improper neutralization of input during web page generation. Successful exploitation requires user interaction and can lead to session theft, privilege escalation, or defacement of the WordPress site.

Critical Impact
Authenticated attackers holding Subscriber accounts can inject persistent scripts that execute against site administrators, enabling account takeover through session hijacking.

Affected Products

WP Cookie Notice for GDPR, CCPA & ePrivacy Consent (gdpr-cookie-consent) plugin versions <= 4.3.9
WordPress installations exposing subscriber registration with the affected plugin enabled
Any site permitting low-privilege authenticated access to plugin-controlled input fields

Discovery Timeline

2026-08-18 - CVE-2026-73359 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-73359

Vulnerability Analysis

The vulnerability resides in the WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin, which manages cookie consent banners on WordPress sites. The plugin fails to properly sanitize or encode user-supplied input before rendering it in the browser. An authenticated attacker with Subscriber privileges can submit payloads containing HTML or JavaScript that persist in plugin-controlled fields. When another user, typically an administrator, views the affected page, the browser executes the injected script under the site's origin.

The attack crosses a security scope boundary. A Subscriber, one of the lowest WordPress roles, gains the ability to influence content rendered to higher-privileged users. This scope change is reflected in the CVSS vector component S:C. The UI:R requirement means the victim must load the page containing the payload for execution to occur.

Root Cause

The root cause is missing output encoding and input validation on user-controlled fields exposed to Subscriber-level accounts. The plugin trusts stored input and echoes it into rendered HTML without applying WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses(). This lets attacker-controlled markup break out of the intended context and execute as script.

Attack Vector

Exploitation requires a valid Subscriber account and network access to the target WordPress site. The attacker submits a crafted payload through a plugin form or API endpoint accessible to their role. The malicious content is stored server-side and later rendered when a privileged user visits an affected view. The victim's browser executes the payload in the site's session context, enabling cookie theft, forced actions via the WordPress REST API, or injection of a persistent backdoor account. Refer to the Patchstack XSS Vulnerability Report for advisory details.

Detection Methods for CVE-2026-73359

Indicators of Compromise

Unexpected <script>, onerror=, or onload= strings stored in wp_options or plugin-managed database tables related to gdpr-cookie-consent
New WordPress administrator accounts created shortly after a Subscriber submitted content through the plugin
Outbound requests from administrator browsers to unfamiliar domains following visits to plugin-managed pages
Modifications to plugin settings performed from Subscriber session cookies or from unexpected IP addresses

Detection Strategies

Audit plugin database entries for HTML tags, JavaScript event handlers, and encoded payloads such as %3Cscript%3E
Review WordPress user role changes and administrative account creation events for correlation with Subscriber activity
Inspect web server access logs for POST requests from Subscriber accounts to plugin endpoints followed by administrator GET requests to the same views

Monitoring Recommendations

Enable WordPress audit logging to capture user role escalations, option changes, and plugin setting modifications
Deploy a Content Security Policy (CSP) that reports inline script violations to detect attempted execution
Monitor authentication events for administrator logins from geolocations or user agents inconsistent with baseline behavior

How to Mitigate CVE-2026-73359

Immediate Actions Required

Update the WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin to a version later than 4.3.9 as soon as a patched release is available from the vendor
Restrict user registration to trusted individuals and disable the default Subscriber self-registration if not required
Rotate WordPress administrator session cookies and reset passwords if suspicious plugin activity is identified

Patch Information

At time of publication, the NVD entry and the Patchstack XSS Vulnerability Report list all versions <= 4.3.9 as affected. Site operators should monitor the plugin repository for a fixed release and apply it immediately upon publication. Verify the installed version by reviewing the plugin header in wp-content/plugins/gdpr-cookie-consent/.

Workarounds

Temporarily deactivate the gdpr-cookie-consent plugin until a patched version is available
Enforce a strict Content Security Policy that blocks inline script execution on WordPress admin pages
Use a Web Application Firewall (WAF) rule set to filter script tags and event handler attributes in plugin form submissions
Limit access to /wp-admin/ by IP allowlist to reduce administrator exposure to stored payloads

bash

# Configuration example: disable open registration and restrict wp-admin by IP
wp option update users_can_register 0

# Apache: restrict wp-admin to trusted IPs
<Directory "/var/www/html/wp-admin">
    Require ip 203.0.113.0/24
</Directory>