Record Of Consent Extension For Complianz
Monthly
Stored cross-site scripting in the 'Record of Consent Extension for Complianz' WordPress plugin (all versions up to and including 2.5) lets unauthenticated attackers persist arbitrary JavaScript into stored consent records via the 'uid' parameter, which then executes in the browser of any user - including an administrator reviewing the consent records admin tab - who later loads the tainted page. The write path is anonymously reachable because the enforcing nonce is emitted through wp_localize_script on wp_enqueue_scripts, making it readable by any frontend visitor, and no capability or role check gates the write path. It carries a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N); no public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting in the 'Record of Consent Extension for Complianz' WordPress plugin (all versions up to and including 2.5) lets unauthenticated attackers persist arbitrary JavaScript into stored consent records via the 'uid' parameter, which then executes in the browser of any user - including an administrator reviewing the consent records admin tab - who later loads the tainted page. The write path is anonymously reachable because the enforcing nonce is emitted through wp_localize_script on wp_enqueue_scripts, making it readable by any frontend visitor, and no capability or role check gates the write path. It carries a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N); no public exploit code or confirmed active exploitation was identified at time of analysis.