What is GHSA-vcrx-jxcc-gw7f?

GHSA-vcrx-jxcc-gw7f is a security advisory published by GitHub Security Advisories with High severity. The WPLP Cookie Consent WordPress plugin before 4.4.4 does not escape a value submitted through...

Which CVE IDs does GHSA-vcrx-jxcc-gw7f cover?

GHSA-vcrx-jxcc-gw7f covers the following CVE IDs: CVE-2026-85130. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vcrx-jxcc-gw7f?

GHSA-vcrx-jxcc-gw7f has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

GHSA-vcrx-jxcc-gw7fHighCVSS 8.8

The WPLP Cookie Consent WordPress plugin before 4.4.4 does not escape a value submitted through...

Vendor

GitHub Security Advisories

Published

September 17, 2026

Last Modified

September 17, 2026

🔗 CVE IDs covered (1)

CVE-2026-85130 →

📋 Description

The WPLP Cookie Consent WordPress plugin before 4.4.4 does not escape a value submitted through a public endpoint for the JavaScript context it is later output in on an administrative screen, allowing unauthenticated users to run arbitrary JavaScript in the session of an administrator who interacts with the logged entry. Only multisite installations are affected.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-85130
https://wpscan.com/vulnerability/e48e363f-17e5-4b78-90b3-824c0bc47a23
https://github.com/advisories/GHSA-vcrx-jxcc-gw7f