Cross-site scripting in Complianz GDPR/CCPA Cookie Consent Banner
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Elementor Cookie Blocker Regex in all versions up to, and including, 7.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires an administrator to approve the attacker's comment, and the site must have both the Elementor plugin installed and Complianz configured with the Twitter or Facebook cookie/script blocker enabled.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-83561
- 2026-10-03 Alias added: GHSA-99qh-wmgh-87j4
References
Other 10
- https://www.wordfence.com/threat-intel/vulnerabilities/id/c53da813-0376-4c61-bfe0-fd8a2c946937?source=cve
- https://plugins.trac.wordpress.org/browser/complianz-gdpr/tags/7.5.3.1/integrations/plugins/elementor.php#L213
- https://plugins.trac.wordpress.org/browser/complianz-gdpr/tags/7.5.3.1/integrations/plugins/elementor.php#L206
- https://plugins.trac.wordpress.org/browser/complianz-gdpr/tags/7.5.3.1/integrations/plugins/elementor.php#L188
- https://plugins.trac.wordpress.org/browser/complianz-gdpr/tags/7.5.3.1/class-cookie-blocker.php#L828
- https://plugins.trac.wordpress.org/browser/complianz-gdpr/tags/7.5.3.1/class-cookie-blocker.php#L458
- https://plugins.trac.wordpress.org/browser/complianz-gdpr/tags/7.5.3.1/functions.php#L1232
- https://plugins.trac.wordpress.org/changeset?reponame=&new=3686656%40complianz-gdpr%2Ftags%2F7.5.5&old=3674116%40complianz-gdpr%2Ftags%2F7.5.4
- https://plugins.trac.wordpress.org/changeset/3686618/complianz-gdpr/trunk/integrations/plugins/elementor.php
- https://plugins.trac.wordpress.org/changeset?reponame=&new=3686656%40complianz-gdpr%2Ftrunk&old=3674116%40complianz-gdpr%2Ftrunk
More complianz vulnerabilities
- TI-2026-46667 WordPress Complianz plugin <= 7.5.0 - PHP Object Injection vulnerability CVSS 3.1HIGH 7.2
- TI-2026-75157 Stored cross-site scripting in Complianz Cookie Consent Banner via comments CVSS 3.1HIGH 7.2
- TI-2026-46668 WordPress Complianz plugin <= 7.5.0 - Sensitive Data Exposure vulnerability CVSS 3.1MEDIUM 5.3
- TI-2026-03482 Missing authorization in Complianz – GDPR/CCPA Cookie Consent CVSS 3.1MEDIUM 5.3
- TI-2025-10247 Complianz | GDPR/CCPA Cookie Consent <= 7.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVSS 3.1MEDIUM 6.4
- TI-2026-02024 Cross-site scripting in Complianz – GDPR/CCPA Cookie Consent CVSS 3.1MEDIUM 4.9
Sources
- CVE-2026-83561 · CVE Program
- CVE-2026-83561 · NVD
- FIRST EPSS
- GHSA-99qh-wmgh-87j4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences