EUVD-2026-82792
GHSA-99qh-wmgh-87j4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSubmit crafted comment to public form
-
DeliveryComment stored pending moderation
-
ExploitAdministrator approves comment
-
ExecutionPayload rendered via Elementor cookie-blocker regex
-
PersistScript executes in visitor browsers
-
ImpactSession/action abuse in victim context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation is gated by three concrete, largely non-default conditions that all must hold simultaneously: (1) an administrator must manually approve the attacker-submitted comment (comment moderation is enabled by default, so this requires social/timing success or a lax moderator); (2) the Elementor page-builder plugin must be installed and active alongside Complianz; and (3) Complianz must be configured with the Twitter or Facebook cookie/script blocker enabled, which routes comment content through the vulnerable Elementor cookie-blocker regex path. The injection point is public (unauthenticated comment submission, PR:N), but these stacked prerequisites and the required admin approval sharply limit realistic exploitability despite the network attack vector. |
| Impact | This is a moderate-severity stored XSS in a widely-installed WordPress plugin, but its real-world risk is materially lower than the 7.2 CVSS would suggest because of stacked preconditions. The vendor vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) rates it network, low-complexity, unauthenticated with no user interaction - yet the description itself contradicts AC:L/UI:N: successful exploitation REQUIRES an administrator to approve the attacker's comment (that is third-party interaction, UI:R), AND the Elementor plugin must be installed, AND Complianz must be configured with the Twitter or Facebook cookie/script blocker enabled. Those three gates make AC:H/UI:R more honest, yielding an assessed ~6.5. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so this is not a demonstrated active-exploitation priority - it is a patch-on-normal-cadence item. Note the conflict explicitly: CVSS marks UI:N and AC:L, but the description's 'requires an administrator to approve the comment' and 'must have both Elementor installed and a specific blocker enabled' are genuine limiting factors - treat the raw 7.2 as an upper bound. Impact is limited to C:L/I:L (scripted actions in a victim's browser session), not confidentiality or integrity of the server itself. |
| Exploit ScenarioDerived | An unauthenticated attacker posts a blog comment containing a malicious payload crafted so that Complianz's Elementor cookie-blocker regex processing fails to sanitize it. Once a site administrator approves the comment, and provided the site runs Elementor with Complianz's Twitter or Facebook blocker enabled, the stored script executes in the browser of every visitor who views the affected page. No public proof-of-concept was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 18, 2026
Stored cross-site scripting in the Complianz GDPR/CCPA Cookie Consent Banner WordPress plugin, affecting all versions up to and including 7.5.4, allows unauthenticated attackers to embed arbitrary JavaScript in comment content that later executes in the browser of anyone viewing the approved comment page. Realistic exploitation is gated by three conditions that must all hold: a site administrator must approve the attacker's submitted comment, the Elementor page-builder plugin must be installed and active, and Complianz must be configured with the Twitter or Facebook cookie/script blocker enabled so comment content is routed through the vulnerable cookie-blocker regex path; independent assessment rates the vector as AC:H/UI:R despite PR:N, since exploitation depends on a moderator action and a specific third-party configuration. No public exploit code was identified at time of analysis, and there is no confirmed active exploitation (no CISA KEV listing); a vendor patch is available in version 7.5.5.
RemediationAI
Upgrade the Complianz GDPR/CCPA Cookie Consent Banner plugin to version 7.5.5 or later; this is the vendor-released patch and is reflected in the published changesets (trunk and the 7.5.5 tag, new=3686656, plus changeset 3686618 for integrations/plugins/elementor.php). Because the WordPress.org plugin repository distributes updates automatically, administrators who disable auto-updates should apply the 7.5.5 update manually and verify the installed version. If immediate patching is not possible, the most effective compensating control is to disable the Twitter and Facebook cookie/script blockers in the Complianz wizard, which removes comment content from the vulnerable Elementor cookie-blocker regex path at the cost of losing consent-gated handling for those embeds; alternatively, deactivate Complianz's Elementor integration by removing or renaming the plugin's integrations/plugins/elementor.php file, though this breaks Elementor-specific cookie handling and will be reverted by plugin updates. Moderators should also be advised that approving comments containing embedded script- or iframe-like markup can introduce the payload, so comment approval should be treated as a trust boundary and untrusted comment bodies containing HTML/script patterns should be rejected rather than approved, noting that this relies on human vigilance and is not a technical fix. Disabling comments site-wide would eliminate the injection vector but is a heavy functional trade-off. No patch-less configuration should be considered equivalent to the 7.5.5 upgrade, and there is no evidence of active exploitation requiring emergency isolation beyond prompt patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-79 improper neutralization of input during web page generation (stored cross-site scripting) rooted in the Complianz plugin's Elementor integration and its cookie-blocking subsystem. When an administrator has enabled the Twitter or Facebook cookie/script blocker, Complianz intercepts and rewrites third-party embed/script markup, and the Elementor integration file (integrations/plugins/elementor.php, notably the blocks around lines 188, 206 and 213) plus the shared cookie-blocker logic (class-cookie-blocker.php around lines 458 and 828, with supporting helpers in functions.php around line 1232) applies regular-expression-based matching to content, including comment content, without adequate input sanitization and output escaping. Because the regex-processed value is subsequently emitted into the rendered page without proper encoding, attacker-controlled text that survives moderation into a published comment is reinterpreted as HTML/JavaScript in the victim's browser. The affected component is the WordPress plugin/complianz_gdpr/ccpa_cookie_consent_banner package (CPE cpe:2.3:a:complianz:complianz_gdpr/ccpa_cookie_consent_banner:*:*:*:*:*:*:*:*), and the scope change noted in the vendor CVSS reflects that script execution can affect resources beyond the vulnerable component's security authority.
Know when Complianz gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Unauthenticated submission (PR:N) but admin approval is required (UI:R) and multiple non-default conditions (Elementor + specific blocker enabled) justify AC:H; stored XSS gives S:C/C:L/I:L.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Elementor Cookie Blocker Regex in all versions up to, and including, 7.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires an administrator to approve the attacker's comment, and the site must have both the Elementor plugin installed and Complianz configured with the Twitter or Facebook cookie/script blocker enabled.
Executive ViewAI
A stored cross-site scripting flaw in the Complianz GDPR/CCPA Cookie Consent Banner plugin (all versions through 7.5.4) can let an outside party place JavaScript into comment content that then runs in the browsers of staff and visitors viewing the approved comment page. Because Complianz is a consent and privacy component, a successful attack undermines the very trust posture the tool exists to protect and could expose administrator sessions or inject misleading consent prompts. The realistic risk is concentrated on WordPress sites that run the Elementor page builder, have the Twitter or Facebook cookie/script blocker enabled, and rely on human comment moderation - a narrow but identifiable subset of the install base.
No vendor-released patch identified at time of analysis; a fixed version has been referenced by the vendor but no exact version number was provided. Interim mitigations: disable the Twitter and Facebook cookie/script blocker options in Complianz, deactivate Complianz on sites where it is not required, enforce strict comment moderation with HTML sanitization on comment content, limit comment approval privileges to trusted administrators, deploy WAF rules blocking script payloads in comment submissions, and rotate administrator credentials and sessions on any potentially affected site.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
The Complianz WordPress plugin before 6.3.4, and Complianz Premium WordPress plugin before 6.3.6 allow a translators to
The Complianz WordPress plugin before 6.4.2, Complianz Premium WordPress plugin before 6.4.2 do not validate and escape
Stored cross-site scripting in the Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress (all versions up to an
PHP Object Injection in the Complianz WordPress plugin (all versions up to and including 7.5.0) allows an authenticated
Cross-Site Request Forgery (CSRF) vulnerability in Really Simple Plugins Complianz, Really Simple Plugins Complianz Prem
Cross-Site Request Forgery (CSRF) vulnerability in Really Simple Plugins Complianz, Really Simple Plugins Complianz Prem
Unauthenticated sensitive data exposure in the Complianz WordPress plugin (versions up to and including 7.5.0) allows an
Stored Cross-Site Scripting in Complianz - GDPR/CCPA Cookie Consent plugin versions up to 7.4.4.2 allows authenticated a
The Complianz - GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin set
Server-Side Request Forgery in the Complianz WordPress GDPR compliance plugin (versions 7.5.0 and below) allows authenti
The Complianz - GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Cross-Site Request Forgery in all version
Exploit-DB