Complianz Consent Extension EUVD-2026-100908

Exploitation requires that the 'Record of Consent Extension for Complianz' plugin (version 2.5 or earlier) be installed and active on the target WordPress site. The specific enabling weakness is that the enforcing nonce is emitted via wp_localize_script on wp_enqueue_scripts, making it readable by any unauthenticated frontend visitor, and the consent write path performs no capability or role check - so no authentication, special configuration, or user interaction by the attacker is needed. The stored payload executes when a victim (notably an administrator reviewing the consent records admin tab) subsequently loads the injected page, so the practical impact depends on a privileged user later viewing the tainted data. The main limiting factor is deployment: the dependency on this specific, relatively uncommon Complianz add-on narrows the real-world attack surface.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2 HIGH) describes a remotely reachable, low-complexity, unauthenticated stored XSS with a scope change, consistent with the description: the enforcing nonce is leaked to unauthenticated frontend visitors via wp_localize_script and no capability/role check gates the write path, so any anonymous visitor can persist a payload. This is a genuinely attacker-favorable profile for a WordPress flaw because it removes the usual authentication/nonce barrier. However, the real-world risk is tempered by three signals: no EPSS score was provided, there is no CISA KEV listing, and no public POC was supplied - so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. Impact is also bounded (C:L/I:L/A:N) - this is script injection in a browser context, not server compromise. Net: a legitimately high-priority patch for sites running this specific extension due to the unauthenticated stored vector, but not an emergency on the level of a KEV-listed RCE; prioritize based on whether the affected extension is actually installed.

An unauthenticated attacker reads the exposed nonce emitted to frontend visitors, then submits a crafted consent record with a malicious 'uid' value containing JavaScript. The payload is stored without sanitization and later rendered unescaped (e.g., on the admin records tab), executing in the browser of an administrator or any user who views the injected page. No public exploit code was identified at time of analysis, but the low attack complexity and lack of authentication make exploitation straightforward.