CVE-2026-2389

Name of the Vulnerable Software and Affected Versions Complianz – GDPR/CCPA Cookie Consent plugin for WordPress versions prior to 7.4.4.3

Description The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is susceptible to Stored Cross-Site Scripting. This occurs because the revert divs to summary function replaces HTML entities (”) with literal double-quote characters (") in post content without proper sanitization. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute each time a user accesses the compromised page. The Classic Editor plugin must be installed and activated for exploitation.

Recommendations Update Complianz – GDPR/CCPA Cookie Consent plugin for WordPress to version 7.4.4.3 or later.