UNKNOWN NVD

CVE-2026-85130

The WPLP Cookie Consent WordPress plugin before 4.4.4 does not escape a value submitted through a public endpoint for the JavaScript context it is later output

The WPLP Cookie Consent WordPress plugin before 4.4.4 does not escape a value submitted through a public endpoint for the JavaScript context it is later output in on an administrative screen, allowing unauthenticated users to run arbitrary JavaScript in the session of an administrator who interacts with the logged entry. Only multisite installations are affected.

References

https://wpscan.com/vulnerability/e48e363f-17e5-4b78-90b3-824c0bc47a23/

Published: 2026-09-17 · Source: NVD · Feed updated: 2026-09-17

This unknown severity vulnerability was published on 2026-09-17 via NVD.

vulnfeed aggregates 8294 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.