Stored Cross-Site Scripting in Complianz Cookie Consent Plugin for WordPress
CVE-2023-6498
4.4MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 4 January 2024
What is CVE-2023-6498?
The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress has a vulnerability that allows authenticated attackers with administrator-level permissions to exploit Stored Cross-Site Scripting through inadequately sanitized input and output. This affects all versions up to and including 6.5.5, particularly in multi-site installations or where unfiltered_html settings are disabled. By injecting arbitrary web scripts, attackers can affect users accessing manipulated pages, presenting significant risks to site security.
Affected Version(s)
Complianz – GDPR/CCPA Cookie Consent * <= 6.5.5