What the vulnerability does
01Description
The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 7.4.4.2. This is due to the `revert_divs_to_summary` function replacing `”` HTML entities with literal double-quote characters (`"`) in post content without subsequent sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected page. The Classic Editor plugin is required to be installed and activated in order to exploit this vulnerability.
Explanation of Vulnerability in Simple Terms
02Summary
Complianz – GDPR/CCPA Cookie Consent versions 7.4.4.2 and earlier contain a cross-site scripting (XSS) vulnerability. An attacker with low-level privileges can inject malicious scripts that execute in other users' browsers, potentially stealing session data or modifying page content. The vulnerability requires specific conditions to exploit but can affect multiple users across the site.
What an attacker can do
03Attacker Capabilities
Inject malicious scripts that run in other users' browsers and steal data or modify page content.
Potential impact on your site
04Site Impact
Users' sessions and data may be compromised; attackers can deface pages or redirect visitors to malicious sites.
Conditions required to exploit
05Prerequisites
Attacker must have low-level user account access; no user interaction required from victims.
Key dates
06Disclosure timeline
March 26, 2026
CVE published
April 8, 2026
Record updated
