CVE-2026-107631: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in davidevalerio Record of Consent Extension for Complianz

CVE-2026-107631 describes a stored cross-site scripting vulnerability in the Record of Consent Extension for Complianz WordPress plugin (versions <= 2.5). The vulnerability is triggered through the 'uid' parameter, which lacks proper sanitization and escaping. An attacker can inject arbitrary scripts that execute in the context of users visiting the injected page. The enforcement nonce is exposed via wp_localize_script on wp_enqueue_scripts, making it readable by unauthenticated visitors, and there are no capability or role checks on the write path, enabling unauthenticated exploitation.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of users visiting the affected pages. This can lead to information disclosure, session hijacking, or other client-side impacts. The vulnerability has a CVSS 3.1 score of 7.2 (high severity), indicating a significant risk due to network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the plugin's functionality where possible and monitor for updates from the vendor. Avoid exposing the affected plugin on publicly accessible sites or disable it if feasible.