{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/complianz-gdpr/ccpa-cookie-consent-banner--7.5.5/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:complianz:gdpr_ccpa_cookie_consent_banner:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-97339"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Complianz GDPR/CCPA Cookie Consent Banner (\u003c= 7.5.5)"],"_cs_severities":["high"],"_cs_tags":["web-application","xss","wordpress","cve-2026-97339"],"_cs_type":"advisory","_cs_vendors":["Complianz"],"content_html":"\u003cp\u003eThe Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress, in versions 7.5.5 and below, contains a critical Stored Cross-Site Scripting (XSS) vulnerability (CVE-2026-97339). The flaw originates from the yotu-wp Cookie-Blocker filter's failure to properly sanitize and escape input within comment content. An unauthenticated attacker can leverage this by crafting a comment that bypasses the standard WordPress wp_kses sanitization engine. By embedding executable JavaScript tokens within otherwise permitted HTML attribute values, the payload remains dormant until the plugin's output-buffer filter executes a str_replace() operation. This transformation inadvertently modifies the DOM, breaking out of the attribute context and enabling script execution. Because the payload triggers only after the comment is approved, this vector necessitates interaction between an attacker and a site moderator or an automated moderation workflow, posing a significant risk for session hijacking and malicious redirects on affected WordPress sites.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of a victim's browser session. If a site administrator or privileged user views an affected page, the attacker could potentially perform actions on their behalf, steal session cookies, or inject malicious content into the site. The vulnerability affects all WordPress installations utilizing versions 7.5.5 or earlier of the plugin.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade the Complianz GDPR/CCPA Cookie Consent Banner plugin to the latest available version beyond 7.5.5 immediately.\u003c/li\u003e\n\u003cli\u003eImplement strict moderation policies for user comments, especially for unauthenticated or anonymous accounts, to prevent the injection of malicious payloads until an update can be applied.\u003c/li\u003e\n\u003cli\u003eReview audit logs for suspicious comment content that contains unusual attribute strings or obfuscated JavaScript patterns.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-16T04:24:36Z","date_published":"2026-10-16T04:24:36Z","id":"https://feed.craftedsignal.io/briefs/2026-10-complianz-xss/","summary":"The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress (\u003c= 7.5.5) is vulnerable to Stored XSS due to improper input sanitization, allowing unauthenticated attackers to execute arbitrary scripts via comment content.","title":"Stored Cross-Site Scripting in Complianz GDPR/CCPA Cookie Consent Banner","url":"https://feed.craftedsignal.io/briefs/2026-10-complianz-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Complianz GDPR/CCPA Cookie Consent Banner (\u003c= 7.5.5)","version":"https://jsonfeed.org/version/1.1"}