A Stored Cross-Site Scripting vulnerability in the WPLP Cookie Consent plugin for WordPress allows unauthenticated attackers to inject malicious scripts into the application.

This vulnerability (CWE-79) exists due to insufficient sanitization of the 'regionArray' parameter. The attack vector is identified as unauthenticated, meaning no prior login is required to trigger the exploit.

The ability for an attacker to execute arbitrary JavaScript in the browser of a site visitor or administrator poses a severe risk to data integrity and session security. The CVSS score of 7.2 reflects the high potential for impact on site visitors and administrative accounts, potentially leading to unauthorized data access or site-wide disruption.

Immediate Action: Update the WPLP Cookie Consent plugin to version 4.4.0 immediately to resolve the identified security flaw.

Proactive Monitoring: Monitor for suspicious activity or unexpected script modifications within the affected plugin files and surrounding administrative modules.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter out malicious input strings that attempt to exploit XSS vulnerabilities in form parameters.

Public Exploit Available: Unknown.

Administrators must treat this vulnerability with high urgency. Updating to version 4.4.0 is the only effective way to mitigate this risk and ensure site visitors are protected from potential cross-site scripting attacks.