Live › vulnerability › CVE-2026-97339
Go to dashboardThe Complianz GDPR/CCPA Cookie Consent Banner WordPress plugin up to and including 7.5.5 fails to sanitize and escape comment content passed through its yotu-wp Cookie-Blocker filter. An unauthenticated attacker can plant a script in a comment that runs in the browser of any visitor to the affected page once the comment is approved.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Complianz GDPR/CCPA Cookie Consent Banner plugin at version 7.5.5 or earlier. The exploit needs a comment to be approved, so sites that hold all comments for moderation face less immediate exposure. Sites without this plugin can skip it.
No product ranges from the sources yet.
wp plugin get complianz-gdpr --field=version7.5.5, as the sources do not name a fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter in all versions up to, and including, 7.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit bypasses WordPress's wp_kses comment sanitization because the payload uses only allow-listed tags and hides executable tokens inside quoted attribute values as plain text; the XSS is only realized when Complianz's own output-buffer filter performs str_replace() rewrites that break out of the attribute context, and requires the comment to be approved before it executes for visitors.
This page as .md · .json · in your agent: get_signal("CVE-2026-97339")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.