CVE-2026-2389
The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 7.4.4.2.
Published Mar 26, 2026 · updated Jun 17, 2026
The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 7.4.4.2. This is due to the function replacing HTML entities with literal double-quote characters ( ) in post content without subsequent sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected page. The Classic Editor plugin is required to be installed and activated in order to exploit this vulnerability.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 26, 2026 · NIST NVD
Detected
The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 7.4.4.2. This is due to the function replacing HTML entities with literal double-quote characters ( ) in post content without subsequent sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a
Jun 17, 2026 · NIST NVD
Updated
The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 7.4.4.2. This is due to the function replacing HTML entities with literal double-quote characters ( ) in post content without subsequent sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a
Sources
- CVE.orgVulnerability recordCVE-2026-2389
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-2389
The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 7.4.4.2. This is due to the function replacing HTML entities with literal double-quote characters (`
nvd.nist.gov