Stored Cross-Site Scripting in Complianz GDPR/CCPA Cookie Consent Banner Plugin for WordPress

CVE-2026-97339

What is CVE-2026-97339?

The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This flaw arises from inadequate input sanitization and output escaping, allowing unauthenticated attackers to embed malicious scripts through comment content. The exploitation circumvents WordPress's wp_kses comment sanitization by leveraging allowable tags and concealing executable elements within quoted attribute values as plain text. The malicious script executes when the Complianz plugin processes the comment's output, provided it has been approved for visibility. This vulnerability affects users accessing the modified pages.

References