Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-85130— WPLP Cookie Consent < 4.4.4 - Unauthenticated Stored XSS via Consent Logs

Quick assessment

Affected
Unknown WPLP Cookie Consent
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WPLP Cookie Consent WordPress 插件在 4.4.4 版本之前，未对通过公共端点提交并随后在管理界面中输出的值进行 JavaScript 上下文转义。这允许未认证的用户在管理员与日志条目交互时，在其会话中执行任意 JavaScript 代码。此漏洞仅影响多站点（multisite）安装环境。

AI Predicted 7.5 Difficulty: Moderate EPSS 0.51% · P43

Possible ATT&CK Techniques 1 AI

T1189 · Drive-by Compromise

Affected Version Matrix 1

VendorProduct Version RangeStatus
Unknown WPLP Cookie Consent < 4.4.4 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-85130

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
WPLP Cookie Consent < 4.4.4 - Unauthenticated Stored XSS via Consent Logs
Source: CVE Program / CVE List V5
Vulnerability Description
The WPLP Cookie Consent WordPress plugin before 4.4.4 does not escape a value submitted through a public endpoint for the JavaScript context it is later output in on an administrative screen, allowing unauthenticated users to run arbitrary JavaScript in the session of an administrator who interacts with the logged entry. Only multisite installations are affected.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Unknown WPLP Cookie Consent 0 ~ 4.4.4 -

II. Public POCs for CVE-2026-85130

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-85130

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-85130 (1)

Same Patch Batch · Unknown · 2026-09-17 · 29 CVEs total

CVE-2026-86801 8.8 HIGH To Do List Member 1.4 - 1.6 - Unauthenticated Stored XSS, File Listing and Deletion via Un
CVE-2026-87963 8.6 HIGH Yo 1.1 - 1.3.1 - Unauthenticated SQL Injection via username Parameter
CVE-2026-87829 4.3 MEDIUM Checkout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attachment Deletion via Unvalidated
CVE-2026-87831 4.3 MEDIUM Checkout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attachment Deletion via Customer Ad
CVE-2026-91017 3.7 LOW Robokassa payment gateway for Woocommerce < 1.8.9 - Unauthenticated Payment Bypass via For
CVE-2026-91009 Active Products Tables for WooCommerce < 2.1.3 - Subscriber+ Arbitrary Post Title Modifica
CVE-2026-91015 Master Addons for Elementor < 3.1.9 - Unauthenticated Popup Deactivation via jltma_popup_d
CVE-2026-91016 Motors < 1.4.121 - Unauthenticated Draft/Private Listing Disclosure
CVE-2026-91019 Event Booking Manager for WooCommerce < 5.6.0 - Contributor+ Payment Gateway Credential Di
CVE-2026-90923 Autopay < 5.0.1 - Unauthenticated Cross-Customer Order Payment Parameter Disclosure and De
CVE-2026-91008 Event Booking Manager for WooCommerce < 5.3.8 - Unauthenticated Attendee PII Disclosure vi
CVE-2026-91011 EWWW Image Optimizer < 8.7.7 - Author+ Stored XSS via Image Class Attribute Backreference
CVE-2026-91014 Realtyna Organic IDX plugin + WPL Real Estate < 5.4.2 - Reflected XSS via Location Selecto
CVE-2026-91010 Invisible Anti-Spam & CAPTCHA < 5.1.1 - Subscriber+ Arbitrary Form Submission Deletion
CVE-2026-85128 Choose User Role at Registration for WooCommerce < 1.3.3 - Unauthenticated Privilege Escal
CVE-2026-90922 Paid Member Subscriptions < 3.0.9 - Unauthenticated Membership Payment Bypass via PayPal S
CVE-2026-88792 Dictionary <= 1.0 - Unauthenticated Stored XSS via Direct Dictionary Update
CVE-2026-88795 wpShopGermany IT-RECHT KANZLEI < 2.4 - Unauthenticated RCE via Predictable API Token
CVE-2026-88904 PuppyFW <= 0.4.4 - Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privi
CVE-2026-87836 Comments Import & Export 2.1.11 - 2.5.3 - Author+ Comment PII Disclosure via Export

Showing top 20 of 29 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: WPLP Cookie Consent
Same vendor: Unknown