CVE-2026-92977 devowl CVE debrief

Who should care

Defenders responsible for WordPress installations with the Real Cookie Banner plugin should assess exposure and prioritize patching or mitigation. This vulnerability can be exploited by unauthenticated attackers, making it a high-priority issue for defenders to address.

Why it matters

The Real Cookie Banner plugin vulnerability allows unauthenticated attackers to inject malicious scripts, which can lead to cross-site scripting attacks. Defenders should prioritize patching or mitigating this vulnerability to prevent exploitation.

• Unauthenticated attackers can inject arbitrary web scripts in pages
• Injected scripts can execute whenever a user accesses an injected page
• Vulnerability can be exploited through the comment functionality
• Patching or mitigation is required to prevent exploitation

Technical summary

The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 5.3.5. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability is caused by insufficient input sanitization and output escaping in the plugin's comment functionality.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially for WordPress installations with user-generated content or comment sections.

Recommended defensive actions

• Patch or update the Real Cookie Banner plugin to a version beyond 5.3.5
• Implement additional input validation and output escaping for user-generated content
• Monitor for suspicious activity or injected scripts in pages
• Consider using a Web Application Firewall (WAF) to detect and prevent attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by insufficient input sanitization and output escaping in the plugin's comment functionality. Malicious script payloads can be injected in the title attribute of an anchor tag and survive WordPress's comment kses filter at save time.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.