{"id":"CVE-2026-97339","kind":"vulnerability","aliases":["CVE-2026-97339"],"related":[],"title":"Complianz cookie banner plugin: stored XSS via comment content","description":"The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter in all versions up to, and including, 7.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit bypasses WordPress's wp_kses comment sanitization because the payload uses only allow-listed tags and hides executable tokens inside quoted attribute values as plain text; the XSS is only realized when Complianz's own output-buffer filter performs str_replace() rewrites that break out of the attribute context, and requires the comment to be approved before it executes for visitors.","summary":"The Complianz GDPR/CCPA Cookie Consent Banner WordPress plugin up to and including 7.5.5 fails to sanitize and escape comment content passed through its yotu-wp Cookie-Blocker filter. An unauthenticated attacker can plant a script in a comment that runs in the browser of any visitor to the affected page once the comment is approved.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["complianz","package","self-hosted","wordpress"],"not_affected_if":["comments-disabled","comments-held-for-moderation","plugin-not-installed"],"how_to_check":"- Check the installed Complianz version in the WordPress admin plugins list or with `wp plugin get complianz-gdpr --field=version`\n- Confirm whether the site has the yotu-wp Cookie-Blocker filter active, which the sources do not describe further","fix":"- Update Complianz GDPR/CCPA Cookie Consent to a version later than `7.5.5`, as the sources do not name a fixed version\n- Until patched, moderate comments manually and do not approve unknown comments","status":"open","published_at":"2026-10-16T04:18:44+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:29:55+00:00","updated_at":"2026-10-25T03:29:55+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:29:55Z","model":"claude-haiku-5-5","output":{"fix":"- Update Complianz GDPR/CCPA Cookie Consent to a version later than `7.5.5`, as the sources do not name a fixed version\n- Until patched, moderate comments manually and do not approve unknown comments","reach":"internet","title":"Complianz cookie banner plugin: stored XSS via comment content","impact":"medium","summary":"The Complianz GDPR/CCPA Cookie Consent Banner WordPress plugin up to and including 7.5.5 fails to sanitize and escape comment content passed through its yotu-wp Cookie-Blocker filter. An unauthenticated attacker can plant a script in a comment that runs in the browser of any visitor to the affected page once the comment is approved.","category":"package","nicknames":[],"who_cares":["wordpress","complianz","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker script runs in visitors' browsers on affected pages","analyst_note":"Check the NVD entry and the WordPress plugin changelog at https://nvd.nist.gov/vuln/detail/CVE-2026-97339 for a fixed version and whether the filter is on by default.","how_to_check":"- Check the installed Complianz version in the WordPress admin plugins list or with `wp plugin get complianz-gdpr --field=version`\n- Confirm whether the site has the yotu-wp Cookie-Blocker filter active, which the sources do not describe further","needs_analyst":true,"not_affected_if":["plugin-not-installed","comments-disabled","comments-held-for-moderation"],"who_is_affected":"Sites running the Complianz GDPR/CCPA Cookie Consent Banner plugin at version 7.5.5 or earlier. The exploit needs a comment to be approved, so sites that hold all comments for moderation face less immediate exposure. Sites without this plugin can skip it.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000692,"input_tokens":3514,"output_tokens":682,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-97339':12A,15A '7.5.5':34B,114C 'access':143C 'affect':72B 'allow':162C 'allow-list':161C 'approv':78B,206C 'arbitrari':132C 'attack':54B,129C 'attribut':171C,198C 'banner':3A,27B,84C 'blocker':50B,105C 'break':194C 'browser':66B 'buffer':187C 'bypass':149C 'comment':8A,40B,61B,76B,97C,154C,203C 'complianz':1A,16B,23B,80C,182C 'consent':26B,83C 'content':9A,41B,98C 'context':199C 'cooki':2A,25B,49B,82C,104C 'cookie-block':48B,103C 'cross':93C 'cross-sit':92C 'cve':10A,13A 'due':115C 'escap':39B,122C 'execut':139C,167C,209C 'exploit':148C 'fail':35B 'filter':51B,106C,188C 'gdpr/ccpa':24B,81C 'hide':166C 'host':20B 'includ':33B,113C 'inject':131C,145C 'input':118C 'insid':169C 'insuffici':117C 'kses':153C 'list':163C 'make':124C 'output':121C,186C 'output-buff':185C 'packag':17B 'page':73B,136C,146C 'pass':42B 'payload':158C 'perform':189C 'plain':174C 'plant':56B 'plugin':4A,29B,85C 'possibl':126C 'quot':170C 'realiz':180C 'replac':191C 'requir':201C 'rewrit':192C 'run':63B 'sanit':37B,119C,155C 'script':58B,95C,134C 'self':19B 'self-host':18B 'site':94C 'store':5A,91C 'str':190C 'tag':164C 'text':175C 'token':168C 'unauthent':53B,128C 'use':159C 'user':142C 'valu':172C 'version':109C 'via':7A,96C,99C 'visitor':69B,211C 'vulner':89C 'web':133C 'whenev':140C 'wordpress':21B,28B,87C,150C 'wp':47B,102C,152C 'xss':6A,177C 'yotu':46B,101C 'yotu-wp':45B,100C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Complianz GDPR/CCPA Cookie Consent Banner plugin at version 7.5.5 or earlier. The exploit needs a comment to be approved, so sites that hold all comments for moderation face less immediate exposure. Sites without this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T04:18:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97339","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97339","severity":null,"published_at":"2026-10-16T04:18:44+00:00","modified_at":"2026-10-16T17:18:01+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}