CVE-2026-97339: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in complianz Complianz GDPR/CCPA Cookie Consent Banner

CVE-2026-97339 is a stored cross-site scripting vulnerability in the Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress, affecting all versions up to and including 7.5.5. The issue stems from insufficient sanitization and escaping of comment content processed through the yotu-wp Cookie-Blocker Filter. Attackers can inject scripts that bypass WordPress's wp_kses sanitization by using allowed tags and hiding executable tokens inside quoted attribute values. These scripts become active when Complianz's output-buffer filter performs string replacements that break out of attribute contexts. The attack requires the malicious comment to be approved before execution occurs for visitors. This vulnerability allows unauthenticated attackers to execute arbitrary web scripts in the context of affected pages.

Successful exploitation allows unauthenticated attackers to inject and execute arbitrary scripts in the context of the affected website's pages, potentially leading to information disclosure and limited integrity impact. The vulnerability does not affect availability. The attack requires comment approval, limiting immediate exploitation but still posing a significant risk to site visitors and administrators.

No explicit patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should review and moderate comments carefully to prevent approval of malicious content. Consider disabling or restricting the yotu-wp Cookie-Blocker Filter if feasible as a temporary mitigation.