Stored Cross-Site Scripting in Complianz Cookie Consent Plugin for WordPress
CVE-2023-6498

4.4MEDIUM

Key Information:

Vendor
Wordpress
Status
Complianz – GDPR/CCPA Cookie Consent
Vendor
CVE Published:
4 January 2024

Summary

The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress has a vulnerability that allows authenticated attackers with administrator-level permissions to exploit Stored Cross-Site Scripting through inadequately sanitized input and output. This affects all versions up to and including 6.5.5, particularly in multi-site installations or where unfiltered_html settings are disabled. By injecting arbitrary web scripts, attackers can affect users accessing manipulated pages, presenting significant risks to site security.

Affected Version(s)

Complianz – GDPR/CCPA Cookie Consent * <= 6.5.5

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
4.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Craig Smith
.