A high-severity Cross-Site Scripting vulnerability in the WPLP Cookie Consent plugin allows unauthenticated attackers to execute arbitrary JavaScript in the context of an administrator session.

This is a stored Cross-Site Scripting (CWE-79) vulnerability where an unauthenticated attacker can inject malicious scripts via a public endpoint. The payload is subsequently executed when an administrator views the affected entry within the plugin dashboard on multisite WordPress installations.

The vulnerability poses a severe risk to organizational security, as successful exploitation allows an attacker to perform unauthorized actions on behalf of a site administrator. Given the CVSS score of 8.8, this flaw could lead to complete account takeover, unauthorized configuration changes, or the deployment of further malicious payloads, resulting in significant data compromise or service disruption.

Immediate Action: Update the WPLP Cookie Consent WordPress plugin to version 4.4.4 or later immediately.

Proactive Monitoring: Monitor administrative audit logs for unusual plugin activity or unauthorized changes to site settings that may indicate a compromised administrator session.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common cross-site scripting patterns in incoming HTTP requests to public endpoints.

Public Exploit Available: Unknown

This vulnerability represents a critical security risk for WordPress multisite environments due to the potential for full administrative compromise. Administrators must prioritize updating the WPLP Cookie Consent plugin to version 4.4.4 immediately to resolve the lack of input sanitization and prevent potential exploitation.