CVE-2025-49390

The WordPress Cookie Notice & Consent plugin versions up to and including 1.6.4 contain a Stored Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation [1]. This flaw enables attackers to inject arbitrary scripts that persist in the application.

Exploitation requires a privileged user to perform an action, such as clicking a malicious link or visiting a crafted page [1]. Once triggered, the injected script executes in the context of other users' sessions when they visit the affected site, making it a typical stored XSS attack scenario.

A successful attack could allow a malicious actor to inject scripts that redirect visitors, display advertisements, or embed other HTML payloads [1]. This could compromise site integrity and user trust, and is considered moderately dangerous with potential for mass exploitation campaigns.

Mitigation is available by updating to version 1.6.5 or later [1]. Patchstack has also issued a mitigation rule to block attacks until the update is applied [1]. Users unable to update immediately should consult their hosting provider or web developer for assistance [1].