CVE-2026-2389 is a stored cross-site scripting vulnerability in the Complianz – GDPR/CCPA Cookie Consent WordPress plugin affecting all versions up to 7.4.4.2. The issue stems from the revert_divs_to_summary function that replaces the HTML entity ” with a literal double-quote character in post content without proper sanitization. This flaw allows authenticated users with Contributor or higher privileges to inject arbitrary JavaScript into pages, which executes when other users access those pages. The Classic Editor plugin must be installed and activated for exploitation. The vulnerability has a CVSS 3.1 base score of 4.9 (medium severity), with network attack vector, high attack complexity, low privileges required, no user interaction, and impacts confidentiality and integrity with no availability impact.

An attacker with Contributor-level or higher access can inject persistent malicious scripts into WordPress pages via the vulnerable plugin, potentially leading to unauthorized actions or data exposure when other users view the affected pages. The impact affects confidentiality and integrity but does not affect availability. Exploitation requires the Classic Editor plugin to be active, limiting the attack surface. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling the Classic Editor plugin if not required, as its presence is necessary for exploitation. Monitor vendor communications for updates and apply any released patches promptly.