CVE-2026-83561

Name of the Vulnerable Software and Affected Versions Complianz GDPR/CCPA Cookie Consent Banner versions prior to 7.5.5

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS) via comment content. This occurs through the Elementor Cookie Blocker Regex, enabling the injection of arbitrary web scripts that execute when a user visits the affected page. Successful exploitation requires an administrator to approve the malicious comment, the installation of the Elementor plugin, and the configuration of Complianz with the Twitter or Facebook cookie/script blocker enabled.

Recommendations Update to a version newer than 7.5.4. As a temporary mitigation, disable the Twitter or Facebook cookie/script blocker in the Complianz configuration.