The Record of Consent Extension for Complianz plugin for WordPress is vulnerable to stored Cross‑Site Scripting because the uid parameter accepts unsanitized input that is later rendered without proper escaping. As a result, an unauthenticated attacker can inject arbitrary JavaScript that will be executed automatically whenever a user loads a page containing the stored record. The flaw originates from insufficient input validation (CWE‑79) and a missing capability check that allows privileged writes to occur in the absence of authentication.

This vulnerability affects the Record of Consent Extension for Complianz plugin for WordPress, in all releases up to and including version 2.5. Users running these versions are at risk if the plugin is enabled on their sites.

The CVSS score of 7.2 indicates a high severity with medium‑to‑high potential impact. The EPSS score of under 1% shows a low probability of exploitation in the wild, and the vulnerability is not currently listed in the CISA KEV catalog. Nonetheless, the attack vector is remote and requires no special credentials; an unauthenticated attacker can craft a malicious uid value and have it stored, causing the script to run for any subsequent user who views the affected page.