CVE-2026-97640 smub CVE debrief

Who should care

Defenders responsible for WordPress installations using the WPConsent plugin should assess their exposure and prioritize verification of the plugin version. They should also monitor for unusual comment activity and prepare for updating the plugin to a fixed version.

Why it matters

The WPConsent plugin for WordPress has a Stored Cross-Site Scripting vulnerability that allows unauthenticated attackers to inject arbitrary web scripts. Defenders should verify their exposure, monitor for exploitation attempts, and prepare for remediation.

• Defenders need to verify if their WordPress installations are using a vulnerable version of the WPConsent plugin.
• They should monitor for unusual comment activity that could indicate attempted exploitation.
• The vulnerability requires the Script Blocking feature to be enabled, which may affect the attack surface.
• Defenders should prioritize updating the plugin to a fixed version as soon as it becomes available.

Technical summary

The WPConsent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit chain requires the Script Blocking feature to be enabled and involves submitting two coordinated comments.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations, especially if the Script Blocking feature is enabled. They should also monitor for unusual comment activity and ensure that the plugin is updated to a fixed version as soon as it becomes available.

Recommended defensive actions

• Verify the presence of the WPConsent plugin version 1.1.9 or earlier in your WordPress installation.
• Monitor for unusual comment activity on your WordPress site.
• Consider disabling the Script Blocking feature if not essential.
• Update the WPConsent plugin to a fixed version as soon as it becomes available.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability details are based on information from the CVE Program and the National Vulnerability Database (NVD). The exploit chain involves submitting two coordinated comments, one with event-handler syntax inside an allowed <code> element and another with a deterministic ___noise___ restoration key inside an allowed <abbr title> attribute. The key offset can be confirmed via an unauthenticated wpconsent_debug=1 request.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.