CVE-2026-83561 is a stored cross-site scripting vulnerability in the Complianz GDPR/CCPA Cookie Consent Banner WordPress plugin affecting all versions up to 7.5.4. The vulnerability is due to insufficient sanitization and escaping of comment content processed by the Elementor Cookie Blocker Regex. An unauthenticated attacker can inject arbitrary web scripts that execute when users access the affected pages, but successful exploitation requires administrative approval of the malicious comment and specific plugin configurations (Elementor installed and Complianz configured with Twitter or Facebook cookie/script blocker enabled).

Successful exploitation allows an attacker to execute arbitrary scripts in the context of users visiting the affected site, potentially leading to information disclosure or user session compromise. The attack requires an administrator to approve the malicious comment, limiting the ease of exploitation. There is no indication of active exploitation in the wild.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should carefully review and approve comments, especially if the site uses Elementor and Complianz with Twitter or Facebook cookie/script blocking enabled. Consider disabling the affected features or plugins if feasible.