CVE-2026-1084

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

The Cookie consent for developers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple settings fields in all versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
lovor	Cookie consent for developers	<= 1.7.1

References

Timeline

Published: Jan 24, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-108407.1A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated gr CVE-2026-1084008.8Integer overflow or wraparound in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network.CVE-2026-1084018.8Heap-based buffer overflow in Windows Remote Desktop Services allows an authorized attacker to execute code over a network.CVE-2026-1084025.3Missing release of memory after effective lifetime in Windows Layer-2 Bridge Network Driver allows an unauthorized attacker to deny service CVE-2026-1084037.8Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-1084046.8Heap-based buffer overflow in Windows CD-ROM Driver allows an unauthorized attacker to execute code with a physical attack.CVE-2026-1084057.8Integer overflow or wraparound in Windows CD-ROM Driver allows an authorized attacker to elevate privileges locally.CVE-2026-1084067.0Use after free in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally.CVE-2026-1084077.8Out-of-bounds read in Windows GDI allows an authorized attacker to elevate privileges locally.CVE-2026-1084085.5Out-of-bounds read in Windows Telephony Service allows an authorized attacker to disclose information locally.CVE-2026-1084095.5Exposure of sensitive system information to an unauthorized control sphere in Windows Overlay Filter allows an authorized attacker to disclo CVE-2026-108416.5IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTT