CVE-2026-1084

The Cookie consent for developers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple settings fields in all versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

• CWE-79

• https://plugins.trac.wordpress.org/browser/cookie-consent-for-developers/tags/1.7.1/admin/class-ntg-cookie-consent-admin.php#L112
• https://plugins.trac.wordpress.org/browser/cookie-consent-for-developers/tags/1.7.1/admin/partials/ntg-cookie-consent-admin-display.php#L108
• https://plugins.trac.wordpress.org/browser/cookie-consent-for-developers/trunk/admin/class-ntg-cookie-consent-admin.php#L112
• https://plugins.trac.wordpress.org/browser/cookie-consent-for-developers/trunk/admin/partials/ntg-cookie-consent-admin-display.php#L108
• https://www.wordfence.com/threat-intel/vulnerabilities/id/c16918a9-7b73-418d-adbd-aa17cb1d8cf8?source=cve

Published

Jan 24, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10833The Gutenberg Essential Blocks – Page Builder for Gutenberg …6.4
• CVE-2026-10834The WP Travel Engine WordPress plugin before 6.8.1 does not…4.6
• CVE-2026-10835The SALESmanago & Leadoo WordPress plugin before 3.11.3 does…7.7
• CVE-2026-10836Improper handling of HTTP headers that allows a remote attac…5.1
• CVE-2026-10837Open redirection vulnerability due to insufficient validatio…5.1
• CVE-2026-10839Open redirection vulnerability in the authentication system …5.1
• CVE-2026-10840A flaw was found in the OpenShift Pipelines operator. The te…7.1
• CVE-2026-10842IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSph…7.5
• CVE-2026-10843A flaw was found in the OpenShift Cloud Credential Operator …7.2
• CVE-2026-10845IBM WebSphere Application Server 8.5 and 9.0 could allow a r…7.3
• CVE-2026-10846NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, wh…7.5
• CVE-2026-10847A local privilege escalation vulnerability exists in Check P…7.8