Stored cross-site scripting in Complianz Cookie Consent Banner via comments
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is affected in all versions up to and including 7.5.5. Insufficient input sanitization and output escaping (CWE-79) let an unauthenticated attacker store comment content that Complianz's output-buffer filter later rewrites into executable script. The script runs in a visitor's browser when that visitor accesses an injected page, and the comment must be approved before it executes for visitors.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter in all versions up to, and including, 7.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit bypasses WordPress's wp_kses comment sanitization because the payload uses only allow-listed tags and hides executable tokens inside quoted attribute values as plain text; the XSS is only realized when Complianz's own output-buffer filter performs str_replace() rewrites that break out of the attribute context, and requires the comment to be approved before it executes for visitors.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for Complianz GDPR/CCPA Cookie Consent Banner.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-16 Threatist record created from CVE-2026-97339
- 2026-10-16 Priority changed: MEDIUM → LOW
- 2026-10-16 Alias added: GHSA-h8f6-jw33-7cr8
- 2026-10-16 CISA SSVC decision points changed
References
Other 6
- https://www.wordfence.com/threat-intel/vulnerabilities/id/3c12e65c-eedf-4fc2-977a-7a07219ee1c2?source=cve
- https://plugins.trac.wordpress.org/browser/complianz-gdpr/tags/7.5.5/integrations/plugins/yotu-wp.php#L18
- https://plugins.trac.wordpress.org/browser/complianz-gdpr/tags/7.5.5/integrations/plugins/yotu-wp.php#L7
- https://plugins.trac.wordpress.org/browser/complianz-gdpr/tags/7.5.5/class-cookie-blocker.php#L828
- https://plugins.trac.wordpress.org/browser/complianz-gdpr/tags/7.5.5/class-cookie-blocker.php#L458
- https://plugins.trac.wordpress.org/changeset/3743098/complianz-gdpr/trunk/integrations/plugins/yotu-wp.php
More complianz vulnerabilities
- TI-2026-57690 Cross-site scripting in Complianz GDPR/CCPA Cookie Consent Banner CVSS 3.1HIGH 7.2
- TI-2026-46667 WordPress Complianz plugin <= 7.5.0 - PHP Object Injection vulnerability CVSS 3.1HIGH 7.2
- TI-2026-46668 WordPress Complianz plugin <= 7.5.0 - Sensitive Data Exposure vulnerability CVSS 3.1MEDIUM 5.3
- TI-2026-03482 Missing authorization in Complianz – GDPR/CCPA Cookie Consent CVSS 3.1MEDIUM 5.3
- TI-2025-10247 Complianz | GDPR/CCPA Cookie Consent <= 7.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVSS 3.1MEDIUM 6.4
- TI-2026-02024 Cross-site scripting in Complianz – GDPR/CCPA Cookie Consent CVSS 3.1MEDIUM 4.9
Sources
- CVE-2026-97339 · CVE Program
- CVE-2026-97339 · NVD
- FIRST EPSS
- GHSA-h8f6-jw33-7cr8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences