CVE-2026-97339

Name of the Vulnerable Software and Affected Versions Complianz GDPR/CCPA Cookie Consent Banner versions prior to 7.5.6

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS) via comment content. The issue occurs when the yotu-wp Cookie-Blocker Filter uses str replace() rewrites in its output-buffer filter, which can break out of the attribute context and execute arbitrary web scripts. This method bypasses the wp kses() comment sanitization by using allow-listed tags and hiding executable tokens within quoted attribute values as plain text. The execution of the script requires the comment to be approved before it affects visitors.

Recommendations Update to a version newer than 7.5.5.