Cookie Banner for GDPR/CCPA <=4.3.5 Authenticated Stored XSS (CVE-2026-13360) Advisory

Vulnerability Overview Vulnerability Name: Cookie Banner for GDPR / CCPA <= 4.3.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'regionArray' Parameter Vulnerability Type: Stored Cross-Site Scripting (Stored XSS) CVSS Score: 7.2 (High) CVE ID: CVE-2026-13360 Publication Date: August 14, 2026 Last Updated: August 15, 2026 Researcher: Naoya Takahashi (nako) Impact Scope Affected Versions: Cookie Banner for GDPR / CCPA <= 4.3.5 Vulnerability Description: This vulnerability allows authenticated users (at least at the Subscriber level) to execute arbitrary JavaScript code on the page by injecting malicious scripts into the 'regionArray' parameter. Successful exploitation requires the "Support Google Consent Mode (GCM)" setting to be enabled by an administrator. Remediation Fixed Version: 4.4.0 or later Recommended Action: Update to the latest version to fix this vulnerability. Additional Information References: - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org Related Vulnerabilities Recent Vulnerability List: - Cookie Banner for GDPR / CCPA – WPLP Cookie Consent <= 4.3.7 - Cross-Site Request Forgery via Bulk Action to Delete/Resolve Entries (CVE-2026-15136, CVSS 4.3) - Cookie Banner for GDPR / CCPA <= 4.3.6 - Authenticated (Administrator+) SQL Injection via 'scan_id' Parameter (CVE-2026-14475, CVSS 4.9) - Cookie Banner for GDPR / CCPA <= 4.3.6 - Missing Authorization to Authenticated (Subscriber+) Scan Schedule Modification via gcc_save_schedule_scan AJAX Action (CVE-2026-12955, CVSS 4.3) - Cookie Banner for GDPR / CCPA <= 4.3.5 - Authenticated (Administrator+) SQL Injection via 'i' Parameter (CVE-2026-12920, CVSS 4.9) - Cookie Banner, Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) - WP Cookie Consent <= 4.1.2 - Missing Authorization to Sensitive Information Exposure (CVE-2025-11754, CVSS 7.5) - Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.0.3 - Missing Authorization (CVE-2025-66080, CVSS 5.3) - Cookie Banner, Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) - WP Cookie Consent <= 4.0.7 - Missing Authorization to Unauthenticated Arbitrary Post Deletion (CVE-2025-14061, CVSS 5.3) - Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.0.7 - Missing Authorization (CVE-2025-66133, CVSS 5.3) - Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.0.3 - Missing Authorization (CVE-2025-66075, CVSS 4.3) - WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 3.8.0 - Cross-Site Request Forgery (CVE-2025-49285, CVSS 4.3) Summary This vulnerability involves a Stored Cross-Site Scripting attack in the Cookie Banner for GDPR / CCPA plugin, affecting versions 4.3.5 and earlier. Users are advised to update to version 4.4.0 or later to remediate this issue.

Goal Reached Thanks to every supporter — we hit 100%!

Cookie Banner for GDPR/CCPA <=4.3.5 Authenticated Stored XSS (CVE-2026-13360) Advisory

More from this source