---
id: CVE-2026-83561
title: >-
  The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is
  vulnerable to Stored Cross-Site Scripting via Comment Content via Elementor
  Cookie Blocker Regex in all versions up to, and including, 7.5.4 due to
  insufficient input …
summary: >-
  The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is
  vulnerable to Stored Cross-Site Scripting via Comment Content via Elementor
  Cookie Blocker Regex in all versions up to, and including, 7.5.4 due to
  insufficient input …
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
vendor: complianz
product: Complianz GDPR/CCPA Cookie Consent Banner
affected:
  - gdpr_ccpa_cookie_consent_banner <= 7.5.4
published: '2026-09-18'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T13:23:37.403'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-83561'
references:
  - url: >-
      https://plugins.trac.wordpress.org/browser/complianz-gdpr/tags/7.5.3.1/class-cookie-blocker.php#L458
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/complianz-gdpr/tags/7.5.3.1/class-cookie-blocker.php#L828
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/complianz-gdpr/tags/7.5.3.1/functions.php#L1232
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/complianz-gdpr/tags/7.5.3.1/integrations/plugins/elementor.php#L188
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/complianz-gdpr/tags/7.5.3.1/integrations/plugins/elementor.php#L206
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/complianz-gdpr/tags/7.5.3.1/integrations/plugins/elementor.php#L213
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/changeset/3686618/complianz-gdpr/trunk/integrations/plugins/elementor.php
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/changeset?reponame=&new=3686656%40complianz-gdpr%2Ftags%2F7.5.5&old=3674116%40complianz-gdpr%2Ftags%2F7.5.4
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/changeset?reponame=&new=3686656%40complianz-gdpr%2Ftrunk&old=3674116%40complianz-gdpr%2Ftrunk
    label: security@wordfence.com
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/c53da813-0376-4c61-bfe0-fd8a2c946937?source=cve
    label: security@wordfence.com
tags:
  - nvd
  - cve.org
epss: 0.00508
epssPercentile: 0.40969
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-18T10:44:07.626184Z'
ingestedAt: '2026-09-18T08:38:04.112Z'
---

## Overview

The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Elementor Cookie Blocker Regex in all versions up to, and including, 7.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires an administrator to approve the attacker's comment, and the site must have both the Elementor plugin installed and Complianz configured with the Twitter or Facebook cookie/script blocker enabled.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.