Stored Cross-Site Scripting in Complianz GDPR/CCPA Cookie Consent Banner for WordPress

CVE-2026-83561

What is CVE-2026-83561?

The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress contains a vulnerability that allows unauthorized users to exploit stored cross-site scripting (XSS) through comment content. This issue arises from insufficient sanitization of user input and improper escaping of output, enabling attackers to inject malicious scripts into pages. The successful execution of such a script requires an administrator to approve the comment containing the exploit. Additionally, the vulnerability is relevant only when the Elementor plugin is enabled and Complianz is configured to utilize cookie/script blockers for platforms like Twitter or Facebook.

References