The CVSS 7.2 score for this stored XSS in a WordPress consent management plugin obscures a more dangerous reality. The vulnerability requires the 'Support Google Consent Mode (GCM)' setting to be enabled, which the CVE frames as a constraint—but this setting is precisely what high-value, compliance-focused sites implement. You are not looking at a narrowed attack surface; you are looking at a targeting mechanism that concentrates exploitation against sites running analytics, tracking pixels, and ad-tech integration. The operators most likely to enable GCM are exactly the operators most likely to run high-traffic properties where this exploit yields value.
The capability model compounds this. Subscriber-level access in WordPress is trivially obtained—open registration is the default on countless sites. A subscriber can inject a persistent XSS payload into a compliance-related setting that renders in the cookie consent banner, weaponizing an interface users expect to be trustworthy. But the escalation path doesn't stop at cookie theft. The injected script runs in a context that has programmatic access to the consent state the plugin manages. If the payload can read or modify that consent state, you have a GDPR compliance bypass vector—not just an XSS, but a mechanism that can hijack the very decisions users make about data processing.
The CVE language mentioning 'unauthenticated attackers' against an AJAX handler that requires authentication creates a critical ambiguity. Either there is a separate unauthenticated vector not yet characterized, or the disclosure recorded both findings sequentially. Investigate whether the stored payload itself can be injected without any authentication—this fundamentally changes the blast radius from 'any authenticated user' to 'anyone with a browser hitting the target.'
Treat this as a recurring pattern in consent management plugins rather than an isolated incident. The architecture of these tools consistently treats compliance configuration as a non-security boundary, and the same failure mode recurs across vendors. Beyond patching the plugin, audit your database for orphaned consent configuration data that may persist after plugin changes—these artifacts represent targeted infrastructure now inheriting compromised state.