Complianz
Monthly
Stored cross-site scripting in the Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress (all versions up to and including 7.5.5) allows unauthenticated commenters to plant script payloads in comment content that execute in visitors' browsers once the comment is approved and rendered. The flaw is a bypass of WordPress's wp_kses comment sanitization: the payload uses only allow-listed tags and hides executable tokens as plain text inside quoted attribute values, and the XSS is only realized when Complianz's own Cookie-Blocker output-buffer filter applies str_replace() rewrites that break out of the attribute context. Attack complexity is assessed as High rather than Low, because exploitation requires the Cookie-Blocker output buffering and the yotu-wp integration code path to be active, and critically requires a moderator to approve the malicious comment before it renders; no public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation. Overall this is a real but non-urgent, lower-tier issue gated by human comment moderation rather than a mass-exploitation priority.
Stored cross-site scripting in the Complianz GDPR/CCPA Cookie Consent Banner WordPress plugin, affecting all versions up to and including 7.5.4, allows unauthenticated attackers to embed arbitrary JavaScript in comment content that later executes in the browser of anyone viewing the approved comment page. Realistic exploitation is gated by three conditions that must all hold: a site administrator must approve the attacker's submitted comment, the Elementor page-builder plugin must be installed and active, and Complianz must be configured with the Twitter or Facebook cookie/script blocker enabled so comment content is routed through the vulnerable cookie-blocker regex path; independent assessment rates the vector as AC:H/UI:R despite PR:N, since exploitation depends on a moderator action and a specific third-party configuration. No public exploit code was identified at time of analysis, and there is no confirmed active exploitation (no CISA KEV listing); a vendor patch is available in version 7.5.5.
PHP Object Injection in the Complianz WordPress plugin (all versions up to and including 7.5.0) allows an authenticated user with Administrator privileges to inject serialized PHP objects that the plugin later deserializes, enabling arbitrary object instantiation and potential remote code execution or data manipulation. The flaw stems from unsafe deserialization (CWE-502) and carries a CVSS 7.2 (High). No public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was privately disclosed by Patchstack.
Unauthenticated sensitive data exposure in the Complianz WordPress plugin (versions up to and including 7.5.0) allows any remote, unauthenticated attacker to retrieve sensitive information from affected WordPress installations. Classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), the flaw is particularly notable because Complianz handles GDPR and cookie consent compliance data - meaning exposed information may carry regulatory implications beyond what the CVSS score alone conveys. No public exploit has been identified at time of analysis, and the vulnerability has not been listed in CISA KEV.
Server-Side Request Forgery in the Complianz WordPress GDPR compliance plugin (versions 7.5.0 and below) allows authenticated attackers with Author-level privileges or higher to forge requests from the server, enabling internal network probing and limited confidentiality and integrity impact. The Scope:Changed CVSS metric confirms the vulnerability crosses the server's trust boundary, a characteristic consistent with SSRF enabling access to internal resources unreachable by the attacker directly. No public exploit code has been identified at time of analysis, and the high privilege requirement (PR:H) substantially limits opportunistic exploitation.
Stored Cross-Site Scripting in Complianz - GDPR/CCPA Cookie Consent plugin versions up to 7.4.4.2 allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript into WordPress pages via the `revert_divs_to_summary` function, which improperly converts HTML entities to unescaped characters without subsequent sanitization. The vulnerability requires both the Classic Editor plugin and authenticated user privileges, limiting exposure to internal threats. No public exploit identified at time of analysis, and CISA KEV status is not confirmed.
The Complianz - GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.5.6. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
The Complianz - GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to and including 6.5.5 due to insufficient input. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Cross-Site Request Forgery (CSRF) vulnerability in Really Simple Plugins Complianz, Really Simple Plugins Complianz Premium allows Cross-Site Request Forgery.4.5; Complianz Premium: from n/a through. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Really Simple Plugins Complianz, Really Simple Plugins Complianz Premium allows Cross-Site Scripting (XSS).4.4; Complianz Premium: from n/a through. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Complianz WordPress plugin before 6.4.2, Complianz Premium WordPress plugin before 6.4.2 do not validate and escape some of its shortcode attributes before outputting them back in a page/post. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Complianz WordPress plugin before 6.3.4, and Complianz Premium WordPress plugin before 6.3.6 allow a translators to inject arbitrary SQL through an unsanitized translation. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Stored cross-site scripting in the Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress (all versions up to and including 7.5.5) allows unauthenticated commenters to plant script payloads in comment content that execute in visitors' browsers once the comment is approved and rendered. The flaw is a bypass of WordPress's wp_kses comment sanitization: the payload uses only allow-listed tags and hides executable tokens as plain text inside quoted attribute values, and the XSS is only realized when Complianz's own Cookie-Blocker output-buffer filter applies str_replace() rewrites that break out of the attribute context. Attack complexity is assessed as High rather than Low, because exploitation requires the Cookie-Blocker output buffering and the yotu-wp integration code path to be active, and critically requires a moderator to approve the malicious comment before it renders; no public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation. Overall this is a real but non-urgent, lower-tier issue gated by human comment moderation rather than a mass-exploitation priority.
Stored cross-site scripting in the Complianz GDPR/CCPA Cookie Consent Banner WordPress plugin, affecting all versions up to and including 7.5.4, allows unauthenticated attackers to embed arbitrary JavaScript in comment content that later executes in the browser of anyone viewing the approved comment page. Realistic exploitation is gated by three conditions that must all hold: a site administrator must approve the attacker's submitted comment, the Elementor page-builder plugin must be installed and active, and Complianz must be configured with the Twitter or Facebook cookie/script blocker enabled so comment content is routed through the vulnerable cookie-blocker regex path; independent assessment rates the vector as AC:H/UI:R despite PR:N, since exploitation depends on a moderator action and a specific third-party configuration. No public exploit code was identified at time of analysis, and there is no confirmed active exploitation (no CISA KEV listing); a vendor patch is available in version 7.5.5.
PHP Object Injection in the Complianz WordPress plugin (all versions up to and including 7.5.0) allows an authenticated user with Administrator privileges to inject serialized PHP objects that the plugin later deserializes, enabling arbitrary object instantiation and potential remote code execution or data manipulation. The flaw stems from unsafe deserialization (CWE-502) and carries a CVSS 7.2 (High). No public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was privately disclosed by Patchstack.
Unauthenticated sensitive data exposure in the Complianz WordPress plugin (versions up to and including 7.5.0) allows any remote, unauthenticated attacker to retrieve sensitive information from affected WordPress installations. Classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), the flaw is particularly notable because Complianz handles GDPR and cookie consent compliance data - meaning exposed information may carry regulatory implications beyond what the CVSS score alone conveys. No public exploit has been identified at time of analysis, and the vulnerability has not been listed in CISA KEV.
Server-Side Request Forgery in the Complianz WordPress GDPR compliance plugin (versions 7.5.0 and below) allows authenticated attackers with Author-level privileges or higher to forge requests from the server, enabling internal network probing and limited confidentiality and integrity impact. The Scope:Changed CVSS metric confirms the vulnerability crosses the server's trust boundary, a characteristic consistent with SSRF enabling access to internal resources unreachable by the attacker directly. No public exploit code has been identified at time of analysis, and the high privilege requirement (PR:H) substantially limits opportunistic exploitation.
Stored Cross-Site Scripting in Complianz - GDPR/CCPA Cookie Consent plugin versions up to 7.4.4.2 allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript into WordPress pages via the `revert_divs_to_summary` function, which improperly converts HTML entities to unescaped characters without subsequent sanitization. The vulnerability requires both the Classic Editor plugin and authenticated user privileges, limiting exposure to internal threats. No public exploit identified at time of analysis, and CISA KEV status is not confirmed.
The Complianz - GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.5.6. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
The Complianz - GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to and including 6.5.5 due to insufficient input. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Cross-Site Request Forgery (CSRF) vulnerability in Really Simple Plugins Complianz, Really Simple Plugins Complianz Premium allows Cross-Site Request Forgery.4.5; Complianz Premium: from n/a through. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Really Simple Plugins Complianz, Really Simple Plugins Complianz Premium allows Cross-Site Scripting (XSS).4.4; Complianz Premium: from n/a through. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Complianz WordPress plugin before 6.4.2, Complianz Premium WordPress plugin before 6.4.2 do not validate and escape some of its shortcode attributes before outputting them back in a page/post. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Complianz WordPress plugin before 6.3.4, and Complianz Premium WordPress plugin before 6.3.6 allow a translators to inject arbitrary SQL through an unsanitized translation. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.