CVE-2023-3388
published 2023-06-24CVE-2023-3388: The Beautiful Cookie Consent Banner for WordPress is vulnerable to Stored Cross-Site Scripting via the 'nsc_bar_content_href' parameter in versions up to, and…
PriorityP279medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
84.46%
99.7th percentile
The Beautiful Cookie Consent Banner for WordPress is vulnerable to Stored Cross-Site Scripting via the 'nsc_bar_content_href' parameter in versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A partial patch was made available in 2.10.1 and the issue was fully patched in 2.10.2.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| beautiful-cookie-banner | beautiful_cookie_consent_banner | <= 2.10.1 | — |
| nikelschubert | beautiful_cookie_consent_banner | <= 2.10.1 | — |
Detection & IOCsextracted from sources · hover to see the quote
commandnsc_bar_activate_banner=1&nsc_bar_activate_test_banner=0&nsc_bar_content_href=%22%20style%3ddisplay%3ablock%3bcontent-visibility%3aauto%20oncontentvisibilityautostatechange%3d%22alert(document.domain)&nsc_bar_type=opt-in↗
- →Exploit targets the 'nsc_bar_content_href' parameter via an unauthenticated POST to /wp-admin/admin-post.php, injecting a style/event-handler XSS payload using 'oncontentvisibilityautostatechange'. ↗
- →Unauthenticated POST requests to /wp-admin/admin-post.php with the parameter 'nsc_bar_content_href' containing URL-encoded quote/style/event-handler sequences should be flagged as exploitation attempts. ↗
- →The attack is part of a documented large-scale XSS campaign; correlate with Wordfence threat intel for campaign-level detection. ↗
- ·A partial patch was released in version 2.10.1; the vulnerability is only fully remediated in 2.10.2. Installations on 2.10.1 remain exploitable. ↗
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
vulncheck7.2HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Beautiful Cookie Consent Banner Plugin up to 2.10.1 on WordPress nsc_bar_content_href cross site scripting
vuldb·2026-04-10·CVSS 7.2
CVE-2023-3388 [HIGH] Beautiful Cookie Consent Banner Plugin up to 2.10.1 on WordPress nsc_bar_content_href cross site scripting
A vulnerability, which was classified as problematic, was found in Beautiful Cookie Consent Banner Plugin up to 2.10.1 on WordPress. This issue affects some unknown processing. Such manipulation of the argument nsc_bar_content_href leads to cross site scripting.
This vulnerability is documented as CVE-2023-3388. The attack can be executed remotely. There is not any exploit available.
You should upgrade the affected component.
GHSA
GHSA-mc5q-54j2-f34q: The Beautiful Cookie Consent Banner for WordPress is vulnerable to Stored Cross-Site Scripting via the 'nsc_bar_content_href' parameter in versions up
ghsa_unreviewed·2023-06-24
CVE-2023-3388 [MEDIUM] CWE-79 GHSA-mc5q-54j2-f34q: The Beautiful Cookie Consent Banner for WordPress is vulnerable to Stored Cross-Site Scripting via the 'nsc_bar_content_href' parameter in versions up
The Beautiful Cookie Consent Banner for WordPress is vulnerable to Stored Cross-Site Scripting via the 'nsc_bar_content_href' parameter in versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A partial patch was made available in 2.10.1 and the issue was fully patched in 2.10.2.
VulnCheck
beautiful-cookie-banner beautiful_cookie_consent_banner Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
vulncheck·2023·CVSS 7.2
CVE-2023-3388 [HIGH] beautiful-cookie-banner beautiful_cookie_consent_banner Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
beautiful-cookie-banner beautiful_cookie_consent_banner Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The Beautiful Cookie Consent Banner for WordPress is vulnerable to Stored Cross-Site Scripting via the 'nsc_bar_content_href' parameter in versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A partial patch was made available in 2.10.1 and the issue was fully patched in 2.10.2.
Affected: beautiful-cookie-banner beautiful_cookie_consent_banner
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product i
No detection rules found.
Nuclei
Beautiful Cookie Consent Banner < 2.10.2 - Cross-Site Scripting
nuclei·CVSS 6.1
CVE-2023-3388 [MEDIUM] Beautiful Cookie Consent Banner < 2.10.2 - Cross-Site Scripting
Beautiful Cookie Consent Banner < 2.10.2 - Cross-Site Scripting
The Beautiful Cookie Consent Banner for WordPress is vulnerable to Stored Cross-Site Scripting via the 'nsc_bar_content_href' parameter in versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A partial patch was made available in 2.10.1 and the issue was fully patched in 2.10.2.
Template:
id: CVE-2023-3388
info:
name: Beautiful Cookie Consent Banner < 2.10.2 - Cross-Site Scripting
author: daffainfo
severity: high
description: |
The Beautiful Cookie Consent Banner for WordPress is vulnerable to Stored Cross-Site Scripting via t
No writeups or analysis indexed.
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2857982%40beautiful-and-responsive-cookie-consent&new=2857982%40beautiful-and-responsive-cookie-consent&sfp_email=&sfph_mail=https://www.wordfence.com/blog/2023/05/wordfence-firewall-blocks-bizarre-large-scale-xss-campaign/https://www.wordfence.com/threat-intel/vulnerabilities/id/542a4079-b1a2-49bc-9ddd-ba7978c9992e?source=cvehttps://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2857982%40beautiful-and-responsive-cookie-consent&new=2857982%40beautiful-and-responsive-cookie-consent&sfp_email=&sfph_mail=https://www.wordfence.com/blog/2023/05/wordfence-firewall-blocks-bizarre-large-scale-xss-campaign/https://www.wordfence.com/threat-intel/vulnerabilities/id/542a4079-b1a2-49bc-9ddd-ba7978c9992e?source=cve
2023-06-24
Published
Exploited in the wild