Complianz Cookie Consent CVE-2026-97339

Exploitation requires the site to run the Complianz GDPR/CCPA Cookie Consent Banner plugin (≤7.5.5) with its Cookie-Blocker output-buffer filtering active and the yotu-wp integration code path in effect, plus a public comment form that accepts unauthenticated submissions. The payload must be constructed from wp_kses allow-listed tags with executable tokens hidden in quoted attribute values, relying specifically on Complianz's str_replace() rewrites to break the attribute context. The key limiting factor is that the malicious comment MUST be approved by a moderator before it renders for visitors, so sites requiring manual comment approval gate the attack behind human review; the script then executes only when a visitor loads the page hosting the approved comment.

Signals are mixed and point to a real but non-urgent, lower-tier issue rather than a mass-exploitation priority. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) frames this as remote, unauthenticated, low-complexity with a changed scope - the elevated score is driven mainly by S:C and PR:N. However, the description contradicts the AC:L rating: realized exploitation requires a multi-stage bypass (payload restricted to wp_kses allow-listed tags, executable tokens hidden in quoted attribute values, and reliance on Complianz's own output-buffer str_replace() rewrites to break attribute context), which is materially more complex than AC:L implies - this should be treated as high-complexity. Critically, the comment must also be approved by a moderator before it executes for visitors, a human gating step that sharply reduces drive-by mass exploitation. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so exploitation is 'no public exploit identified at time of analysis.' Net: a legitimate stored-XSS flaw worth patching on a normal cadence, but the AC:L/PR:N optics overstate real-world ease of exploitation given the convoluted bypass and the required comment-approval step.

An unauthenticated attacker submits a blog comment containing only WordPress-allow-listed HTML tags, concealing executable tokens as plain text inside quoted attribute values so it survives wp_kses sanitization. A site moderator approves the comment; when any visitor later loads that page, Complianz's Cookie-Blocker output-buffer filter performs str_replace() rewrites (via the yotu-wp integration) that break out of the attribute context and realize the injected script in the visitor's browser. No public exploit code is identified at time of analysis.