CVE-2025-1622: 
WordPress vulnerability analysis and mitigation

The GDPR Cookie Compliance WordPress plugin before version 4.15.7 contains a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered on February 23, 2025, and is tracked as CVE-2025-1622. This security issue affects WordPress installations, particularly in multisite setups where the unfiltered_html capability is disabled (WPScan).

The vulnerability stems from insufficient sanitization and escaping of plugin settings. The CVSS v3.1 base score is 3.5 (LOW) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) (NVD).

When exploited, this vulnerability allows high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks. The impact is particularly significant in multisite setups and installations where unfiltered_html has been disabled. The XSS payload can be triggered on any frontend page where users have not accepted the cookie policy (WPScan).

The vulnerability can be exploited by authenticated users with administrator-level access. A proof of concept exists where an attacker can inject malicious content through the Cookie Banner Settings page in the WordPress admin panel, specifically in the "Cookie Banner Content" field while in Text mode (WPScan).

The vulnerability has been patched in version 4.15.7 of the GDPR Cookie Compliance plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).