Complianz
Monthly
PHP Object Injection in the Complianz WordPress plugin (all versions up to and including 7.5.0) allows an authenticated user with Administrator privileges to inject serialized PHP objects that the plugin later deserializes, enabling arbitrary object instantiation and potential remote code execution or data manipulation. The flaw stems from unsafe deserialization (CWE-502) and carries a CVSS 7.2 (High). No public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was privately disclosed by Patchstack.
Unauthenticated sensitive data exposure in the Complianz WordPress plugin (versions up to and including 7.5.0) allows any remote, unauthenticated attacker to retrieve sensitive information from affected WordPress installations. Classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), the flaw is particularly notable because Complianz handles GDPR and cookie consent compliance data - meaning exposed information may carry regulatory implications beyond what the CVSS score alone conveys. No public exploit has been identified at time of analysis, and the vulnerability has not been listed in CISA KEV.
Server-Side Request Forgery in the Complianz WordPress GDPR compliance plugin (versions 7.5.0 and below) allows authenticated attackers with Author-level privileges or higher to forge requests from the server, enabling internal network probing and limited confidentiality and integrity impact. The Scope:Changed CVSS metric confirms the vulnerability crosses the server's trust boundary, a characteristic consistent with SSRF enabling access to internal resources unreachable by the attacker directly. No public exploit code has been identified at time of analysis, and the high privilege requirement (PR:H) substantially limits opportunistic exploitation.
Stored Cross-Site Scripting in Complianz - GDPR/CCPA Cookie Consent plugin versions up to 7.4.4.2 allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript into WordPress pages via the `revert_divs_to_summary` function, which improperly converts HTML entities to unescaped characters without subsequent sanitization. The vulnerability requires both the Classic Editor plugin and authenticated user privileges, limiting exposure to internal threats. No public exploit identified at time of analysis, and CISA KEV status is not confirmed.
The Complianz - GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.5.6. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
The Complianz - GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to and including 6.5.5 due to insufficient input. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Cross-Site Request Forgery (CSRF) vulnerability in Really Simple Plugins Complianz, Really Simple Plugins Complianz Premium allows Cross-Site Request Forgery.4.5; Complianz Premium: from n/a through. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Really Simple Plugins Complianz, Really Simple Plugins Complianz Premium allows Cross-Site Scripting (XSS).4.4; Complianz Premium: from n/a through. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Complianz WordPress plugin before 6.4.2, Complianz Premium WordPress plugin before 6.4.2 do not validate and escape some of its shortcode attributes before outputting them back in a page/post. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Complianz WordPress plugin before 6.3.4, and Complianz Premium WordPress plugin before 6.3.6 allow a translators to inject arbitrary SQL through an unsanitized translation. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
PHP Object Injection in the Complianz WordPress plugin (all versions up to and including 7.5.0) allows an authenticated user with Administrator privileges to inject serialized PHP objects that the plugin later deserializes, enabling arbitrary object instantiation and potential remote code execution or data manipulation. The flaw stems from unsafe deserialization (CWE-502) and carries a CVSS 7.2 (High). No public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was privately disclosed by Patchstack.
Unauthenticated sensitive data exposure in the Complianz WordPress plugin (versions up to and including 7.5.0) allows any remote, unauthenticated attacker to retrieve sensitive information from affected WordPress installations. Classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), the flaw is particularly notable because Complianz handles GDPR and cookie consent compliance data - meaning exposed information may carry regulatory implications beyond what the CVSS score alone conveys. No public exploit has been identified at time of analysis, and the vulnerability has not been listed in CISA KEV.
Server-Side Request Forgery in the Complianz WordPress GDPR compliance plugin (versions 7.5.0 and below) allows authenticated attackers with Author-level privileges or higher to forge requests from the server, enabling internal network probing and limited confidentiality and integrity impact. The Scope:Changed CVSS metric confirms the vulnerability crosses the server's trust boundary, a characteristic consistent with SSRF enabling access to internal resources unreachable by the attacker directly. No public exploit code has been identified at time of analysis, and the high privilege requirement (PR:H) substantially limits opportunistic exploitation.
Stored Cross-Site Scripting in Complianz - GDPR/CCPA Cookie Consent plugin versions up to 7.4.4.2 allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript into WordPress pages via the `revert_divs_to_summary` function, which improperly converts HTML entities to unescaped characters without subsequent sanitization. The vulnerability requires both the Classic Editor plugin and authenticated user privileges, limiting exposure to internal threats. No public exploit identified at time of analysis, and CISA KEV status is not confirmed.
The Complianz - GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.5.6. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
The Complianz - GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to and including 6.5.5 due to insufficient input. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Cross-Site Request Forgery (CSRF) vulnerability in Really Simple Plugins Complianz, Really Simple Plugins Complianz Premium allows Cross-Site Request Forgery.4.5; Complianz Premium: from n/a through. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Really Simple Plugins Complianz, Really Simple Plugins Complianz Premium allows Cross-Site Scripting (XSS).4.4; Complianz Premium: from n/a through. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Complianz WordPress plugin before 6.4.2, Complianz Premium WordPress plugin before 6.4.2 do not validate and escape some of its shortcode attributes before outputting them back in a page/post. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Complianz WordPress plugin before 6.3.4, and Complianz Premium WordPress plugin before 6.3.6 allow a translators to inject arbitrary SQL through an unsanitized translation. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.