CVE-2026-8977: WP GDPR Cookie Consent XSS Vulnerability

CVE-2026-8977 Overview

CVE-2026-8977 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP GDPR Cookie Consent plugin for WordPress, affecting all versions up to and including 1.0.0. The flaw resides in the ninja_gdpr_ajax_actions AJAX action handler. The handleAjaxCalls() function lacks both capability and nonce verification, while the generateCSS() function echoes stored gdprConfig values directly into a <style> block on wp_head without escaping. Authenticated users with subscriber-level access or above can inject persistent JavaScript that executes when any visitor loads an affected page. The issue is classified under CWE-79.

Critical Impact
Subscriber-level accounts can store arbitrary JavaScript that executes for every site visitor, enabling session theft, admin account takeover, and site-wide content manipulation.

Affected Products

WP GDPR Cookie Consent plugin for WordPress
All versions up to and including 1.0.0
WordPress sites permitting subscriber-level registration with the plugin installed

Discovery Timeline

2026-06-09 - CVE-2026-8977 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-8977

Vulnerability Analysis

The vulnerability chains three distinct security failures in the plugin's AJAX endpoint. First, the handleAjaxCalls() function in GdprHandler.php registers the ninja_gdpr_ajax_actions action without invoking current_user_can() or check_ajax_referer(). Any authenticated user, including the lowest-privileged subscriber role, can therefore reach the handler.

Second, the handler accepts arbitrary gdprConfig values from the POST body and persists them to the WordPress options table without sanitization through functions such as sanitize_text_field() or wp_kses().

Third, the generateCSS() function reads the stored configuration and concatenates the values directly into a <style> element emitted on the wp_head hook. Because output is not passed through esc_attr() or esc_html(), a payload that breaks out of the CSS context with a closing </style> tag followed by a <script> block executes in the browser of every visitor rendering the page.

Root Cause

The root cause is broken access control combined with missing input sanitization and missing output escaping. The plugin trusts authenticated callers implicitly and treats configuration data as safe at both write and render time.

Attack Vector

An attacker registers or authenticates as a subscriber, then submits a crafted POST request to /wp-admin/admin-ajax.php with action=ninja_gdpr_ajax_actions and a gdprConfig payload containing a script breakout sequence. The payload persists in the database and renders on every front-end page load. Refer to the Wordfence Vulnerability Report and the vulnerable handler source for the affected code paths.

No verified public exploit code is currently available. The vulnerability mechanism is described in prose to avoid fabricated payloads.

Detection Methods for CVE-2026-8977

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php with action=ninja_gdpr_ajax_actions originating from subscriber accounts.
Stored WordPress option values under the plugin's namespace containing <script>, </style>, javascript:, or event handler attributes such as onerror= and onload=.
Unexpected <style> or <script> content rendered in the <head> section of public pages.
New or recently active subscriber accounts created shortly before configuration changes.

Detection Strategies

Audit the wp_options table for plugin-owned keys and inspect stored values for HTML or JavaScript syntax.
Review web server access logs for admin-ajax.php requests carrying the ninja_gdpr_ajax_actions action parameter.
Inspect rendered HTML from public pages for script content emitted inside or adjacent to the plugin's <style> block.
Correlate AJAX handler invocations with low-privilege user sessions that should not be modifying site configuration.

Monitoring Recommendations

Alert on any non-administrator account invoking plugin AJAX endpoints.
Enable WordPress activity logging to capture options table writes and authenticated AJAX activity.
Monitor for HTTP responses containing unexpected <script> tags injected through plugin-rendered CSS.
Track new subscriber registrations on sites that do not require subscriber accounts for normal operation.

How to Mitigate CVE-2026-8977

Immediate Actions Required

Deactivate and remove the WP GDPR Cookie Consent plugin until a patched release is available.
Audit existing subscriber accounts and remove any that are unrecognized or recently created.
Inspect and purge stored plugin configuration values that contain HTML or JavaScript.
Force a password reset for administrator accounts to revoke any sessions that may have been hijacked.

Patch Information

No fixed version is identified in the available CVE data. All versions through 1.0.0 remain affected. Monitor the plugin source repository and the Wordfence advisory for patch announcements.

Workarounds

Disable open user registration in WordPress under Settings → General by unchecking "Anyone can register".
Restrict access to /wp-admin/admin-ajax.php from untrusted networks where feasible.
Apply a web application firewall rule to block POST requests where action=ninja_gdpr_ajax_actions originates from non-administrator sessions.
Replace the plugin with an actively maintained GDPR consent solution that enforces capability and nonce checks.

bash

# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate wp-gdpr-cookie-consent
wp plugin delete wp-gdpr-cookie-consent

# Audit subscriber accounts created in the last 30 days
wp user list --role=subscriber --fields=ID,user_login,user_registered --format=table

# Remove stored plugin options after deactivation
wp option delete gdprConfig