Stored Cross-Site Scripting in Record of Consent Extension for WordPress by Complianz
CVE-2026-107631

7.2HIGH

Key Information:

Vendor

WordPress
Status
Record Of Consent Extension For Complianz
Vendor
CVE Published:
14 October 2026

What is CVE-2026-107631?

The Record of Consent Extension for Complianz plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping within the 'uid' parameter. This vulnerability enables malicious attackers to inject arbitrary scripts into pages accessed by users. The lack of proper nonce enforcement and absence of capability checks allows unauthenticated users to easily exploit this weakness, leading to potentially severe impacts on site integrity and user security.

Affected Version(s)

Record of Consent Extension for Complianz 0 <= 2.5

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/record-of-cons...
https://plugins.trac.wordpress.org/browser/record-of-cons...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

OKISO
.