WordPress security vulnerability WordPress plugin -Update

Reportedly, a researcher from NinTechNet, Jerome Bruandet, has discovered a serious vulnerability in the GDPR Cookie Consent plugin. The bug, considering the 700,000+ active installations of the plugin, could have risked thousands of websites. As explained in a blog post, Bruandet, found a critical XSS flaw in the plugin that existed due to lack of capability checks in AJAX endpoint. In turn, it exposed the values autosave_contant_data and save_contentdata, enabling an attacker to conduct malicious activities. Specifically, exploiting save_contentdata could have let an adversary to pull published data offline, or entirely delete it. Whereas, exploiting autosave_contant_data could allow injecting malicious JavaScript codes to the site. Alongside Bruandet, the team Wordfence has also reviewed this vulnerability after they noticed updates in the plugin. The flaw particularly caught their attention after the plugin was closed for review, as stated in their post. They have deemed the bug a critical severity flaw with a CVSS score of 9.0. Patch Rolled Out The researcher Bruandet found the vulnerability and reported it to the plugin developers on January 28, 2020. The bug affected plugin versions until 1.8.2. Consequently, the developers patched the vulnerability with the release of GDPR Cookie Consent v.1.8.3. Since the fix is out, users must ensure they update their plugin to the latest versions to prevent potential exploits. GDPR Cookie Consent is a dedicated WordPress plugin that facilitates site admins in ensuring site compliance with GDPR.




Source
https://latesthackingnews.com/2020/...pr-cookie-consent-plugin-risks-700k-websites/

If you look on the internet there are currently about 30-40 exploitable XSS, plugins out there for wordpress.
They range from 2yrs old upto a month ago.
Some developers either can't be bothered to patch the plugins, or don't know how.

Do you think some of these reports might be exaggerated in terms of supposed effects? Or really just something for niche audiences like full-on web / word press developers?

Because if some of the reports i've come across are to be believed then even important and renown WP security and eCommerce apps should be avoided like the plague.

Supposed effects are if it's exploitable, it means being able to grab admin username and password. You can only imagine what can be done with that.
Just make sure you secure your website.