CVE-2026-85130 WPLP CVE debrief

Who should care

Defenders responsible for WordPress multisite installations using the WPLP Cookie Consent plugin should assess their exposure and prioritize updating the plugin to version 4.4.4 or later.

Why it matters

CVE-2026-85130 allows unauthenticated attackers to inject arbitrary JavaScript in administrator sessions on multisite WordPress installations using the WPLP Cookie Consent plugin before version 4.4.4. Defenders should prioritize updating the plugin and monitoring for suspicious activity.

• Unauthenticated JavaScript injection in administrator sessions
• Potential for administrative actions to be performed on behalf of the attacker
• Risk of lateral movement within multisite installations

Technical summary

The WPLP Cookie Consent WordPress plugin before 4.4.4 does not properly escape user-submitted values, allowing unauthenticated attackers to inject arbitrary JavaScript code in the context of an administrator's session when they interact with the logged entry. This issue affects only multisite installations. Defenders should prioritize verifying and updating the WPLP Cookie Consent plugin to version 4.4.4 or later, especially for multisite installations. Reviewing and monitoring administrative screens for suspicious activity is also recommended.

Defensive priority

Defenders should prioritize verifying and updating the WPLP Cookie Consent plugin to version 4.4.4 or later, especially for multisite installations.

Recommended defensive actions

• Verify and update the WPLP Cookie Consent plugin to version 4.4.4 or later
• Review and monitor administrative screens for suspicious activity
• Implement additional security measures for multisite installations
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in the WPLP Cookie Consent WordPress plugin before version 4.4.4, which allows unauthenticated attackers to inject arbitrary JavaScript code. Additional information from the vendor and other sources, such as WPScan, may be necessary to fully assess the impact and verify affected scope. Defenders should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance. Evidence limits suggest further review is needed for complete risk

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.