CVE-2026-83561: Complianz GDPR/CCPA Cookie Consent Banner <= 7.5.4 - Unauthenticated Stored Cross-Site Scripting via Elementor Cookie Blocker Regex
The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Elementor Cookie Blocker Regex in all versions up to, and including, 7.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires an administrator to approve the attacker's comment, and the site must have both the Elementor plugin installed and Complianz configured with the Twitter or Facebook cookie/script blocker enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Complianz GDPR/CCPA Cookie Consent Bannerto a version that resolves this vulnerability.Fixed in 7.5.4 - Configuration
Disable the Twitter or Facebook cookie/script blocker in Complianz (the feature using Elementor Cookie Blocker Regex) to eliminate the vulnerable injection path.
Complianz GDPR/CCPA Cookie Consent Banner Twitter or Facebook cookie/script blocker (Elementor Cookie Blocker Regex) = disabled - Compensating control
If you cannot immediately disable the cookie/script blocker, restrict access/ability for administrators to approve comments (since exploitation requires admin approval) so unauthenticated attackers cannot get stored XSS comments approved.
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
Sites using Complianz GDPR/CCPA Cookie Consent Banner version 7.5.4 or earlier are exposed only when Elementor is installed and Complianz has either the Twitter or Facebook cookie/script blocker enabled.
What does an attacker need to exploit it?
An attacker does not need authentication and can submit malicious content through a comment. Exploitation succeeds only if an administrator approves that comment.
How can administrators determine whether exploitation may already have occurred?
Review administrator-approved comments for suspicious or unexpected content, particularly on sites meeting the Elementor and Twitter/Facebook cookie-blocker conditions. Any pages containing content derived from such approved comments may execute injected scripts when visited.