Executive brief
Complianz is a popular WordPress plugin that helps websites manage cookie consent and comply with privacy regulations like GDPR and CCPA. The plugin is vulnerable to stored cross-site scripting (XSS), which allows attackers to inject malicious scripts into website pages. These scripts execute when users visit the affected pages, potentially stealing session data, credentials, or redirecting users to phishing sites. The attack requires admin approval of a malicious comment and both Elementor and specific cookie blockers to be enabled.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the Elementor Cookie Blocker regex component, stemming from insufficient input sanitization and output escaping of user-supplied comment content. An unauthenticated attacker can inject arbitrary JavaScript code in website comments; when an administrator approves the malicious comment, the script is stored in the database and executes in the browsers of all subsequent visitors. Exploitation requires the site to have both Elementor plugin installed and Complianz configured with Twitter or Facebook cookie/script blocker enabled. The vulnerability affects all versions up to and including 7.5.4. Patches are expected to be available in newer versions addressing the sanitization and escaping gaps.
Affected products
- Complianz GDPR/CCPA Cookie Consent Banner up to 7.5.4
Timeline
- 2026-09-18: disclosed