CVE-2026-14989— Cookie Banner for GDPR / CCPA <= 4.4.1 - Unauthenticated Stored Cross-Site Scripting via 'wpl_user_preference' Parameter
Quick assessment
Affected
wplegalpages WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 上的 GDPR / CCPA Cookie Banner – WPLP Cookie Consent 插件（版本 4.4.1 及之前所有版本）存在存储型跨站脚本（Stored Cross-Site Scripting）漏洞。原因是对 “wpl_user_preference” 参数缺乏足够的输入清洗和输出转义。这使得未经身份验证的攻击者能够在页面中注入任意的 Web 脚本，当用户访问被注入的页面时，这些脚本会被执行。 此外，同意记录（consent-logging）的 AJAX 端点对未经身份验
Possible ATT&CK Techniques 1 AI
T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-14989
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cookie Banner for GDPR / CCPA <= 4.4.1 - Unauthenticated Stored Cross-Site Scripting via 'wpl_user_preference' Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpl_user_preference' parameter in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The consent-logging AJAX endpoint is registered for unauthenticated users and its required nonce (wpl_consent_logging_nonce) is publicly emitted via wp_localize_script on the frontend, meaning any unauthenticated site visitor can plant a payload without any prior authentication or privileged access.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| wplegalpages | WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode | 0 ~ 4.4.1 | - |
|
II. Public POCs for CVE-2026-14989
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-14989
请登录查看更多情报信息。
Other References for CVE-2026-14989 (2)
IV. Related Vulnerabilities
Same vendor: wplegalpages
-
CVE-2026-75865
WPLP Cookie Consent <= 4.4.1 - Unauthenticated Arbitrary Fil -
CVE-2026-13360
Cookie Banner for GDPR / CCPA <= 4.3.5 - Authenticated (Subs -
CVE-2026-15136
Cookie Banner for GDPR / CCPA – WPLP Cookie Consent <= 4.3.7 -
CVE-2026-12955
Cookie Banner for GDPR / CCPA <= 4.3.6 - Missing Authorizati -
CVE-2026-14475
Cookie Banner for GDPR / CCPA <= 4.3.6 - Authenticated (Admi
Same weakness: CWE-79
-
CVE-2026-17149
myCred – Points Management System For Gamification, Ranks, B -
CVE-2025-7062
Stored Cross-Site Scripting via file upload in H5P module (h -
CVE-2026-83593
WPBot <= 8.7.3 - Unauthenticated Stored Cross-Site Scripting -
CVE-2026-19945
WP Crowdfunding <= 2.2.1 - Authenticated (Subscriber+) Store -
CVE-2026-75966
Podlove Podcast Publisher <= 4.5.5 - Authenticated (Contribu
V. Comments for CVE-2026-14989
No comments yet