CVE-2026-2389: Complianz – GDPR/CCPA Cookie Consent <= 7.4.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Content Filter
The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 7.4.4.2. This is due to the revertdivstosummary function replacing ” HTML entities with literal double-quote characters (") in post content without subsequent sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected page. The Classic Editor plugin is required to be installed and activated in order to exploit this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2389?
CVE-2026-2389 has a high severity due to the potential for Stored Cross-Site Scripting attacks.
How do I fix CVE-2026-2389?
To fix CVE-2026-2389, update the Complianz – GDPR/CCPA Cookie Consent plugin to a version greater than 7.4.4.2.
What causes the vulnerability CVE-2026-2389?
CVE-2026-2389 is caused by an authenticated stored cross-site scripting vulnerability in the Complianz plugin before version 7.4.4.3.
Who is affected by CVE-2026-2389?
Users of the Complianz – GDPR/CCPA Cookie Consent plugin for WordPress, specifically those using version 7.4.4.2 or earlier, are affected by CVE-2026-2389.
What is Stored Cross-Site Scripting in relation to CVE-2026-2389?
Stored Cross-Site Scripting in CVE-2026-2389 allows attackers to inject malicious scripts that are stored on the server and executed when users access affected pages.