CVE-2026-85130 Overview
CVE-2026-85130 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the WPLP Cookie Consent WordPress plugin versions before 4.4.4. The plugin fails to escape a value submitted through a public endpoint before rendering it in a JavaScript context on an administrative screen. Unauthenticated attackers can inject arbitrary JavaScript that executes when an administrator views the logged entry. Only WordPress multisite installations are affected.
Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in an administrator's browser session, enabling account takeover, session hijacking, and full multisite compromise.
Affected Products
- WPLP Cookie Consent WordPress plugin versions before 4.4.4
- WordPress multisite installations running the affected plugin
- Administrative dashboards rendering plugin-logged entries
Discovery Timeline
- 2026-09-17 - CVE-2026-85130 published to the National Vulnerability Database (NVD)
- 2026-09-17 - Last updated in the NVD database
Technical Details for CVE-2026-85130
Vulnerability Analysis
The WPLP Cookie Consent plugin exposes a public endpoint that accepts and stores user-submitted data. This data is later reflected into an administrative screen inside a JavaScript context without proper output encoding. Because the encoding is missing for the JavaScript sink, attacker-controlled input breaks out of the intended string literal and executes as script code.
The payload runs with the administrator's privileges when the admin views the logged entries page. An attacker can create new administrator accounts, modify plugin or theme code, or pivot to code execution on the site. Multisite installations expand the blast radius because a compromised super administrator can control every site in the network.
Root Cause
The root cause is improper neutralization of input during web page generation. The plugin does not apply a JavaScript-context escaping function such as esc_js() or wp_json_encode() before emitting the stored value into inline <script> content on the admin screen.
Attack Vector
The attack requires no authentication and no prior access. An unauthenticated attacker sends a crafted request to the plugin's public logging endpoint, storing a JavaScript payload. When an administrator later opens the corresponding admin screen, the browser parses and executes the payload in the administrator's session context. User interaction from the administrator is required to trigger execution.
See the WPScan Vulnerability Details for the technical writeup.
// No verified proof-of-concept code is published for CVE-2026-85130.
// Refer to the WPScan advisory linked above for technical details.
Detection Methods for CVE-2026-85130
Indicators of Compromise
- Unexpected <script> tags, javascript: URIs, or event handlers such as onerror= or onload= inside plugin log entries stored in the WordPress database.
- New WordPress administrator or super administrator accounts created shortly after an admin visited the plugin's log screen.
- Outbound HTTP requests from an administrator browser session to unfamiliar domains following log page access.
- Unexpected modifications to theme files, plugin files, or wp_options entries.
Detection Strategies
- Review the plugin's stored log table for entries containing HTML or JavaScript metacharacters such as <, >, ", ', and backticks.
- Inspect web server access logs for POST requests to the plugin's public logging endpoint containing script payloads.
- Correlate administrator dashboard visits with subsequent privileged actions such as user creation or role changes.
Monitoring Recommendations
- Enable WordPress audit logging for user creation, role changes, and plugin or theme file modifications on all multisite network sites.
- Deploy a Content Security Policy (CSP) that restricts inline script execution within wp-admin screens.
- Monitor Web Application Firewall (WAF) logs for XSS signatures targeting the WPLP Cookie Consent endpoints.
How to Mitigate CVE-2026-85130
Immediate Actions Required
- Update the WPLP Cookie Consent plugin to version 4.4.4 or later across every site in the multisite network.
- Audit the plugin's log storage tables and remove any entries containing script payloads.
- Rotate credentials and invalidate active sessions for all administrator and super administrator accounts.
- Review the network user list and remove any unauthorized privileged accounts.
Patch Information
The vendor addressed the vulnerability in WPLP Cookie Consent version 4.4.4. The fix applies proper output escaping to the affected value before it is rendered in the JavaScript context on the administrative screen. Refer to the WPScan Vulnerability Details for advisory information.
Workarounds
- Deactivate the WPLP Cookie Consent plugin until the patched version can be deployed.
- Block public access to the plugin's logging endpoint at the WAF or reverse proxy layer.
- Restrict access to the affected admin screen using IP allowlisting for the /wp-admin/ path.
# Update the plugin across a WordPress multisite network via WP-CLI
wp plugin update wplp-cookie-consent --network
# Verify the installed version is 4.4.4 or later
wp plugin get wplp-cookie-consent --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
