Zetlyn
GitHubGet started

The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Malicious script payloads placed in the title attribute of an anchor tag survive WordPress's comment kses filter at save time, as the payload is only promoted to executable HTML attributes when the plugin's page-wide regex strips the closing quote delimiter at render time; exploitability is therefore subject to the standard comment moderation workflow before the comment is publicly displayed.

zetlyn/cve-nvd vulnerability cve CVE-2026-92977 known 2026-10-03

https://nvd.nist.gov/vuln/detail/CVE-2026-92977

Properties

cvss7.2
receipt
Source
NVD
Its words
7.2
Read by
field:cve.metrics.cvssMetricV31[].cvssData.baseScore
Said since
2026-10-03 06:07 UTC
Last answered
2026-10-05 12:24 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Real Cookie Banner: GDPR & ePrivacy Cookie Consent",
            "vendor": "devowl",
            "versions": [
              {
                "lessThanOrEqual": "5.3.5",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "security@wordfence.com"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Malicious script payloads placed in the title attribute of an anchor tag survive WordPress's comment kses filter at save time, as the payload is only promoted to executable HTML attributes when the plugin's page-wide regex strips the closing quote delimiter at render time; exploitability is therefore subject to the standard comment moderation workflow before the comment is publicly displayed."
      }
    ],
    "id": "CVE-2026-92977",
    "lastModified": "2026-10-03T04:18:04.190",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 2.7,
          "source": "security@wordfence.com",
          "type": "Primary"
        }
      ]
    },
    "published": "2026-10-03T04:18:04.190",
    "references": [
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/real-cookie-banner/tags/5.3.0/inc/view/Blocker.php#L213"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/real-cookie-banner/tags/5.3.0/inc/view/Blocker.php#L233"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/real-cookie-banner/tags/5.3.0/vendor/devowl-wp/fast-html-tag/src/FastHtmlTag.php#L166"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3710645%40real-cookie-banner&new=3710645%40real-cookie-banner"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/32fbba37-208c-4e94-8d07-f3fd14ee2ee1?source=cve"
      }
    ],
    "sourceIdentifier": "security@wordfence.com",
    "vulnStatus": "Received",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-79"
          }
        ],
        "source": "security@wordfence.com",
        "type": "Primary"
      }
    ]
  }
}
productReal Cookie Banner: GDPR & ePrivacy Cookie Consent
receipt
Source
NVD
Its words
Real Cookie Banner: GDPR & ePrivacy Cookie Consent
Read by
field:cve.affected[].affectedData[].product
Said since
2026-10-03 06:07 UTC
Last answered
2026-10-05 12:24 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Real Cookie Banner: GDPR & ePrivacy Cookie Consent",
            "vendor": "devowl",
            "versions": [
              {
                "lessThanOrEqual": "5.3.5",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "security@wordfence.com"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Malicious script payloads placed in the title attribute of an anchor tag survive WordPress's comment kses filter at save time, as the payload is only promoted to executable HTML attributes when the plugin's page-wide regex strips the closing quote delimiter at render time; exploitability is therefore subject to the standard comment moderation workflow before the comment is publicly displayed."
      }
    ],
    "id": "CVE-2026-92977",
    "lastModified": "2026-10-03T04:18:04.190",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 2.7,
          "source": "security@wordfence.com",
          "type": "Primary"
        }
      ]
    },
    "published": "2026-10-03T04:18:04.190",
    "references": [
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/real-cookie-banner/tags/5.3.0/inc/view/Blocker.php#L213"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/real-cookie-banner/tags/5.3.0/inc/view/Blocker.php#L233"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/real-cookie-banner/tags/5.3.0/vendor/devowl-wp/fast-html-tag/src/FastHtmlTag.php#L166"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3710645%40real-cookie-banner&new=3710645%40real-cookie-banner"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/32fbba37-208c-4e94-8d07-f3fd14ee2ee1?source=cve"
      }
    ],
    "sourceIdentifier": "security@wordfence.com",
    "vulnStatus": "Received",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-79"
          }
        ],
        "source": "security@wordfence.com",
        "type": "Primary"
      }
    ]
  }
}
statusReceived
receipt
Source
NVD
Its words
Received
Read by
field:cve.vulnStatus
Said since
2026-10-03 06:07 UTC
Last answered
2026-10-05 12:24 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Real Cookie Banner: GDPR & ePrivacy Cookie Consent",
            "vendor": "devowl",
            "versions": [
              {
                "lessThanOrEqual": "5.3.5",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "security@wordfence.com"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Malicious script payloads placed in the title attribute of an anchor tag survive WordPress's comment kses filter at save time, as the payload is only promoted to executable HTML attributes when the plugin's page-wide regex strips the closing quote delimiter at render time; exploitability is therefore subject to the standard comment moderation workflow before the comment is publicly displayed."
      }
    ],
    "id": "CVE-2026-92977",
    "lastModified": "2026-10-03T04:18:04.190",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 2.7,
          "source": "security@wordfence.com",
          "type": "Primary"
        }
      ]
    },
    "published": "2026-10-03T04:18:04.190",
    "references": [
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/real-cookie-banner/tags/5.3.0/inc/view/Blocker.php#L213"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/real-cookie-banner/tags/5.3.0/inc/view/Blocker.php#L233"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/real-cookie-banner/tags/5.3.0/vendor/devowl-wp/fast-html-tag/src/FastHtmlTag.php#L166"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3710645%40real-cookie-banner&new=3710645%40real-cookie-banner"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/32fbba37-208c-4e94-8d07-f3fd14ee2ee1?source=cve"
      }
    ],
    "sourceIdentifier": "security@wordfence.com",
    "vulnStatus": "Received",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-79"
          }
        ],
        "source": "security@wordfence.com",
        "type": "Primary"
      }
    ]
  }
}
vendordevowl
receipt
Source
NVD
Its words
devowl
Read by
field:cve.affected[].affectedData[].vendor
Said since
2026-10-03 06:07 UTC
Last answered
2026-10-05 12:24 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Real Cookie Banner: GDPR & ePrivacy Cookie Consent",
            "vendor": "devowl",
            "versions": [
              {
                "lessThanOrEqual": "5.3.5",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "security@wordfence.com"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Malicious script payloads placed in the title attribute of an anchor tag survive WordPress's comment kses filter at save time, as the payload is only promoted to executable HTML attributes when the plugin's page-wide regex strips the closing quote delimiter at render time; exploitability is therefore subject to the standard comment moderation workflow before the comment is publicly displayed."
      }
    ],
    "id": "CVE-2026-92977",
    "lastModified": "2026-10-03T04:18:04.190",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 2.7,
          "source": "security@wordfence.com",
          "type": "Primary"
        }
      ]
    },
    "published": "2026-10-03T04:18:04.190",
    "references": [
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/real-cookie-banner/tags/5.3.0/inc/view/Blocker.php#L213"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/real-cookie-banner/tags/5.3.0/inc/view/Blocker.php#L233"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/real-cookie-banner/tags/5.3.0/vendor/devowl-wp/fast-html-tag/src/FastHtmlTag.php#L166"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3710645%40real-cookie-banner&new=3710645%40real-cookie-banner"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/32fbba37-208c-4e94-8d07-f3fd14ee2ee1?source=cve"
      }
    ],
    "sourceIdentifier": "security@wordfence.com",
    "vulnStatus": "Received",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-79"
          }
        ],
        "source": "security@wordfence.com",
        "type": "Primary"
      }
    ]
  }
}

Text

The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Malicious script payloads placed in the title attribute of an anchor tag survive WordPress's comment kses filter at save time, as the payload is only promoted to executable HTML attributes when the plugin's page-wide regex strips the closing quote delimiter at render time; exploitability is therefore subject to the standard comment moderation workflow before the comment is publicly displayed.