Cve-2026-97339 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cve-2026-97339/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 16 Oct 2026 04:24:36 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgStored Cross-Site Scripting in Complianz GDPR/CCPA Cookie Consent Bannerhttps://feed.craftedsignal.io/briefs/2026-10-complianz-xss/Fri, 16 Oct 2026 04:24:36 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-complianz-xss/The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress (<= 7.5.5) is vulnerable to Stored XSS due to improper input sanitization, allowing unauthenticated attackers to execute arbitrary scripts via comment content.The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress, in versions 7.5.5 and below, contains a critical Stored Cross-Site Scripting (XSS) vulnerability (CVE-2026-97339). The flaw originates from the yotu-wp Cookie-Blocker filter's failure to properly sanitize and escape input within comment content. An unauthenticated attacker can leverage this by crafting a comment that bypasses the standard WordPress wp_kses sanitization engine. By embedding executable JavaScript tokens within otherwise permitted HTML attribute values, the payload remains dormant until the plugin's output-buffer filter executes a str_replace() operation. This transformation inadvertently modifies the DOM, breaking out of the attribute context and enabling script execution. Because the payload triggers only after the comment is approved, this vector necessitates interaction between an attacker and a site moderator or an automated moderation workflow, posing a significant risk for session hijacking and malicious redirects on affected WordPress sites.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of a victim's browser session. If a site administrator or privileged user views an affected page, the attacker could potentially perform actions on their behalf, steal session cookies, or inject malicious content into the site. The vulnerability affects all WordPress installations utilizing versions 7.5.5 or earlier of the plugin.

Recommendation

  1. Upgrade the Complianz GDPR/CCPA Cookie Consent Banner plugin to the latest available version beyond 7.5.5 immediately.
  2. Implement strict moderation policies for user comments, especially for unauthenticated or anonymous accounts, to prevent the injection of malicious payloads until an update can be applied.
  3. Review audit logs for suspicious comment content that contains unusual attribute strings or obfuscated JavaScript patterns.
]]>highadvisoryweb-applicationxsswordpresscve-2026-97339