CVE-2026-97339
HighCVSS 7.2Summary
The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress (versions up to and including 7.5.5) is vulnerable to stored Cross-Site Scripting (XSS) via comment content and the yotu-wp Cookie-Blocker filter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute when a user accesses the injected page.
Risk Assessment
An attacker can execute arbitrary JavaScript in a victim's browser, potentially leading to session theft, account takeover, or page content modification. This requires the comment to be approved before it executes for visitors.
Recommendation
Update the Complianz plugin to a version newer than 7.5.5 as soon as it becomes available. Until then, consider disabling the plugin or restricting comment submission.
Other vulnerabilities in Complianz
See all- CVE-2026-65497High
The Complianz plugin versions up to 7.5.0 contain a PHP Object Injection vulnerability exploitable by an administrator. An attacker with admin privileges can inject a malicious PHP object.
- CVE-2026-65496Medium
The Complianz plugin versions 7.5.0 and earlier have a Server-Side Request Forgery (SSRF) vulnerability exploitable by an author. A user with author role can force the server to send requests to internal resources.
- CVE-2026-65498Medium
The Complianz plugin versions 7.5.0 and earlier are vulnerable to unauthenticated sensitive data exposure. Unauthenticated attackers can access confidential information.
Original NVD description (English source)
The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter in all versions up to, and including, 7.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit bypasses WordPress's wp_kses comment sanitization because the payload uses only allow-listed tags and hides executable tokens inside quoted attribute values as plain text; the XSS is only realized when Complianz's own output-buffer filter performs str_replace() rewrites that break out of the attribute context, and requires the comment to be approved before it executes for visitors.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS