EU Cookie Law < 3.1.3 - Authenticated Stored Cross-Site Scripting (XSS)

Description

By exploiting the documented vulnerability, an authenticated attacker with high privileges (administrator) can execute JavaScript code in a victim's browser. By default, in WordPress, administrator users are allowed to inject JavaScript as they have the unfiltered_html capability. The affected form also had Cross-Site Request Forgery (CSRF) protections in place, further lowering the risk of the issue.

The vendor released a fix in version 3.1 but it was not sufficient as it could be easily bypassed.

Due to the mitigating factors, this issue is extremely low risk.