CVE-2026-8977

An authenticated attacker with subscriber-level privileges can exploit this vulnerability by sending a crafted AJAX request to the 'ninja_gdpr_ajax_actions' endpoint. This request should include malicious JavaScript within the `gdprConfig` values, specifically targeting the `styleObj` parameters. Because the `handleAjaxCalls()` function lacks proper capability and nonce checks, and the `generateCSS()` function does not escape the stored configuration values, the injected script is rendered directly into a `<style>` block on the `wp_head` of pages. This allows for stored XSS, executing when any user views the affected page [ref_id=1].

The vulnerability resides in the `handleAjaxCalls()` function, which processes AJAX requests, and the `generateCSS()` function, which outputs the styling. Specifically, the `updateGdprOption()` function, called via AJAX, handles the saving of `gdprConfig` values without sufficient validation. The `addGDPRNotice()` function then calls `generateCSS()` to render these potentially malicious values into the page's `<style>` block [ref_id=1].

The patch addresses the vulnerability by implementing proper capability checks and nonce verification within the `handleAjaxCalls` function, ensuring only authorized users can modify settings. Additionally, input sanitization is applied to the `gdprConfig` values before they are saved, and output escaping is added in the `generateCSS` function to prevent the rendering of malicious scripts. These changes prevent attackers from injecting and executing arbitrary JavaScript through the plugin's configuration settings.