Stored Cross-Site Scripting Vulnerability in Complianz GDPR/CCPA Cookie Consent Plugin for WordPress

CVE-2026-2389

What is CVE-2026-2389?

The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability affecting all versions up to and including 7.4.4.2. This vulnerability arises from the mishandling of HTML entities within the revert_divs_to_summary function, which replaces HTML entities with literal double-quote characters without adequate sanitization. This oversight enables authenticated attackers with Contributor-level access or higher to insert arbitrary web scripts into the page content. Consequently, any user accessing the affected page could unknowingly execute these scripts, potentially leading to data theft or unauthorized actions.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References