CVE-2025-49390: 
WordPress vulnerability analysis and mitigation

The Cookie Notice and Consent WordPress plugin (versions up to and including 1.6.4) contains a Stored Cross-Site Scripting vulnerability (CVE-2025-49390) discovered on August 29, 2025. The vulnerability stems from insufficient input sanitization and output escaping in the plugin's functionality (Rapid7, Patchstack).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue with a CVSS score of 6.0 (AV:N/AC:L/Au:N/C:P/I:P/A:N). The security flaw allows unauthenticated attackers to inject arbitrary web scripts into pages that will execute whenever a user accesses an injected page (Rapid7).

When exploited, this vulnerability enables attackers to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts will execute when visitors access the affected pages (Patchstack).

Website administrators are advised to update to version 1.6.5 or later of the Cookie Notice and Consent plugin to resolve the vulnerability. For users of Patchstack, a mitigation rule has been issued to block any attacks until the update can be applied (Patchstack).