Complianz Gdpr Ccpa Cookie Consent Banner
Monthly
Stored cross-site scripting in the Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress (all versions up to and including 7.5.5) allows unauthenticated commenters to plant script payloads in comment content that execute in visitors' browsers once the comment is approved and rendered. The flaw is a bypass of WordPress's wp_kses comment sanitization: the payload uses only allow-listed tags and hides executable tokens as plain text inside quoted attribute values, and the XSS is only realized when Complianz's own Cookie-Blocker output-buffer filter applies str_replace() rewrites that break out of the attribute context. Attack complexity is assessed as High rather than Low, because exploitation requires the Cookie-Blocker output buffering and the yotu-wp integration code path to be active, and critically requires a moderator to approve the malicious comment before it renders; no public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation. Overall this is a real but non-urgent, lower-tier issue gated by human comment moderation rather than a mass-exploitation priority.
Stored cross-site scripting in the Complianz GDPR/CCPA Cookie Consent Banner WordPress plugin, affecting all versions up to and including 7.5.4, allows unauthenticated attackers to embed arbitrary JavaScript in comment content that later executes in the browser of anyone viewing the approved comment page. Realistic exploitation is gated by three conditions that must all hold: a site administrator must approve the attacker's submitted comment, the Elementor page-builder plugin must be installed and active, and Complianz must be configured with the Twitter or Facebook cookie/script blocker enabled so comment content is routed through the vulnerable cookie-blocker regex path; independent assessment rates the vector as AC:H/UI:R despite PR:N, since exploitation depends on a moderator action and a specific third-party configuration. No public exploit code was identified at time of analysis, and there is no confirmed active exploitation (no CISA KEV listing); a vendor patch is available in version 7.5.5.
Stored cross-site scripting in the Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress (all versions up to and including 7.5.5) allows unauthenticated commenters to plant script payloads in comment content that execute in visitors' browsers once the comment is approved and rendered. The flaw is a bypass of WordPress's wp_kses comment sanitization: the payload uses only allow-listed tags and hides executable tokens as plain text inside quoted attribute values, and the XSS is only realized when Complianz's own Cookie-Blocker output-buffer filter applies str_replace() rewrites that break out of the attribute context. Attack complexity is assessed as High rather than Low, because exploitation requires the Cookie-Blocker output buffering and the yotu-wp integration code path to be active, and critically requires a moderator to approve the malicious comment before it renders; no public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation. Overall this is a real but non-urgent, lower-tier issue gated by human comment moderation rather than a mass-exploitation priority.
Stored cross-site scripting in the Complianz GDPR/CCPA Cookie Consent Banner WordPress plugin, affecting all versions up to and including 7.5.4, allows unauthenticated attackers to embed arbitrary JavaScript in comment content that later executes in the browser of anyone viewing the approved comment page. Realistic exploitation is gated by three conditions that must all hold: a site administrator must approve the attacker's submitted comment, the Elementor page-builder plugin must be installed and active, and Complianz must be configured with the Twitter or Facebook cookie/script blocker enabled so comment content is routed through the vulnerable cookie-blocker regex path; independent assessment rates the vector as AC:H/UI:R despite PR:N, since exploitation depends on a moderator action and a specific third-party configuration. No public exploit code was identified at time of analysis, and there is no confirmed active exploitation (no CISA KEV listing); a vendor patch is available in version 7.5.5.