CVE-2026-85130— WPLP Cookie Consent < 4.4.4 - Unauthenticated Stored XSS via Consent Logs
Quick assessment
Affected
Unknown WPLP Cookie Consent
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WPLP Cookie Consent WordPress 插件在 4.4.4 版本之前，未对通过公共端点提交并随后在管理界面中输出的值进行 JavaScript 上下文转义。这允许未认证的用户在管理员与日志条目交互时，在其会话中执行任意 JavaScript 代码。此漏洞仅影响多站点（multisite）安装环境。
Possible ATT&CK Techniques 1 AI
T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-85130
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WPLP Cookie Consent < 4.4.4 - Unauthenticated Stored XSS via Consent Logs
Source: CVE Program / CVE List V5
Vulnerability Description
The WPLP Cookie Consent WordPress plugin before 4.4.4 does not escape a value submitted through a public endpoint for the JavaScript context it is later output in on an administrative screen, allowing unauthenticated users to run arbitrary JavaScript in the session of an administrator who interacts with the logged entry. Only multisite installations are affected.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | WPLP Cookie Consent | 0 ~ 4.4.4 | - |
|
II. Public POCs for CVE-2026-85130
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-85130
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-85130 (1)
-
🔗 WPLP Cookie Consent < 4.4.4 – Unauthenticated Stored XSS via Consent Logs | CVE 2026-85130 | Plugin Vulnerabilities exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-09-17 · 29 CVEs total
| CVE-2026-86801 | 8.8 HIGH | To Do List Member 1.4 - 1.6 - Unauthenticated Stored XSS, File Listing and Deletion via Un |
| CVE-2026-87963 | 8.6 HIGH | Yo 1.1 - 1.3.1 - Unauthenticated SQL Injection via username Parameter |
| CVE-2026-87829 | 4.3 MEDIUM | Checkout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attachment Deletion via Unvalidated |
| CVE-2026-87831 | 4.3 MEDIUM | Checkout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attachment Deletion via Customer Ad |
| CVE-2026-91017 | 3.7 LOW | Robokassa payment gateway for Woocommerce < 1.8.9 - Unauthenticated Payment Bypass via For |
| CVE-2025-15697 | Dictionary <= 1.0 - Reflected XSS via Multiple Parameters | |
| CVE-2026-85128 | Choose User Role at Registration for WooCommerce < 1.3.3 - Unauthenticated Privilege Escal | |
| CVE-2026-86707 | Private Feed Key <= 0.1 - Unauthenticated Authentication Bypass via 'feedkey' Parameter | |
| CVE-2026-86709 | The Pressengine <= 1.0 - Unauthenticated Authentication Bypass | |
| CVE-2026-86710 | Login with QR <= 1.0.0 - Unauthenticated Authentication Bypass via 'autologin_code' Parame | |
| CVE-2026-86446 | LearnPress 4.4.3 - 4.4.6 - Unauthenticated Quiz Answer Disclosure via check-answer REST En | |
| CVE-2026-87836 | Comments Import & Export 2.1.11 - 2.5.3 - Author+ Comment PII Disclosure via Export | |
| CVE-2026-87786 | Dewa Kirim <= 1.0.0 - Unauthenticated Stored XSS via Checkout Coordinates | |
| CVE-2026-86824 | Newsletter < 9.3.8 - Unauthenticated Subscriber PII Disclosure and Modification via Predic | |
| CVE-2026-86788 | HT Mega 3.2.0 - 3.2.5 - Contributor+ Stored XSS via Section Headline Tag | |
| CVE-2026-90922 | Paid Member Subscriptions < 3.0.9 - Unauthenticated Membership Payment Bypass via PayPal S | |
| CVE-2026-88792 | Dictionary <= 1.0 - Unauthenticated Stored XSS via Direct Dictionary Update | |
| CVE-2026-88795 | wpShopGermany IT-RECHT KANZLEI < 2.4 - Unauthenticated RCE via Predictable API Token | |
| CVE-2026-88904 | PuppyFW <= 0.4.4 - Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privi | |
| CVE-2026-90923 | Autopay < 5.0.1 - Unauthenticated Cross-Customer Order Payment Parameter Disclosure and De |
Showing top 20 of 29 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: WPLP Cookie Consent
-
CVE-2026-85131
WPLP Cookie Consent < 4.4.4 - Arbitrary Post Deletion via CS -
CVE-2026-85133
WPLP Cookie Consent < 4.4.2 - Subscriber+ Missing Authorizat -
CVE-2026-85132
WPLP Cookie Consent 4.0.2 - 4.4.1 - Subscriber+ Cookie Scan -
CVE-2026-82184
WPLP Cookie Consent < 4.4.2 - Unauthenticated IAB TCF Consen -
CVE-2026-82185
WPLP Cookie Consent < 4.4.2 - Subscriber+ Banner Settings Ov
Same vendor: Unknown
-
CVE-2026-87831
Checkout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attac -
CVE-2026-87829
Checkout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attac -
CVE-2026-91017
Robokassa payment gateway for Woocommerce < 1.8.9 - Unauthen -
CVE-2026-86801
To Do List Member 1.4 - 1.6 - Unauthenticated Stored XSS, Fi -
CVE-2026-87963
Yo 1.1 - 1.3.1 - Unauthenticated SQL Injection via username
V. Comments for CVE-2026-85130
No comments yet