PatchSiren cyber security CVE debrief
CVE-2026-13360 wplegalpages CVE debrief
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-15T04:18:01.957Z and has not been modified since then. The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regionArray' parameter in all versions up to, and including, 4.3.5 due to insufficient input sanitization and output escaping. Successful exploitation requires that the site administrator has enabled the 'Support Google Consent Mode (GCM)' setting, which is disabled by default. The AJAX handler performs no nonce or capability check, allowing any authenticated user, including those with Subscriber-level access, to overwrite the affected plugin setting. Administrators of WordPress sites using the Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin should prioritize updating to a patched version, verifying the 'Support Google Consent Mode (GCM)' setting, and ensuring that the plugin's AJAX handler is properly secured.
- Vendor
- wplegalpages
- Product
- WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
- CVSS
- HIGH 7.2
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-08-15
- Original CVE updated
- 2026-08-15
- Advisory published
- 2026-08-15
- Advisory updated
- 2026-08-15
Who should care
Administrators of WordPress sites using the Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin, especially those who have enabled the 'Support Google Consent Mode (GCM)' setting, should be aware of this vulnerability and take steps to mitigate it.
Technical summary
The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regionArray' parameter in all versions up to, and including, 4.3.5. The vulnerability exists due to insufficient input sanitization and output escaping. Successful exploitation requires that the site administrator has enabled the 'Support Google Consent Mode (GCM)' setting, which is disabled by default. The AJAX handler performs no nonce or capability check, allowing any authenticated user, including those with Subscriber-level access, to overwrite the affected plugin setting.
Defensive priority
Administrators of WordPress sites using the Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin should prioritize updating to a patched version, verifying the 'Support Google Consent Mode (GCM)' setting, and ensuring that the plugin's AJAX handler is properly secured.
Recommended defensive actions
- Update to a patched version of the Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin
- Verify the 'Support Google Consent Mode (GCM)' setting and disable it if not required
- Ensure that the plugin's AJAX handler is properly secured
- Monitor for suspicious activity and implement compensating controls as needed
- Perform regular inventory checks to ensure the plugin is up-to-date
Evidence notes
The CVE-2026-13360 record indicates that the Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regionArray' parameter. The vulnerability exists in all versions up to, and including, 4.3.5 due to insufficient input sanitization and output escaping. Successful exploitation requires the site administrator to have enabled the 'Support Google Consent Mode (GCM)' setting, which is disabled by default. The AJAX handler performs no nonce or capability check, allowing any authenticated user, including those with Subscriber-level access, to overwrite the affected plugin setting.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-15T04:18:01.957Z and has not been modified since then.