The Complianz – GDPR/CCPA Cookie Consent plugin contains a stored XSS that lets attackers with Contributor‑level or higher privileges inject arbitrary JavaScript into post content. The vulnerable function replaces encoded quotes with literal quotation marks without sanitizing the content, which causes the injected script to run whenever an affected page is viewed. This can lead to session hijacking, cookie theft, defacement, or further exploitation of the victim’s browser.

WordPress sites running the Complianz plugin on or before version 7.4.4.2 are affected. An authenticated user with Contributor or higher rights can exploit the flaw, and the Classic Editor plugin must be installed and activated for the attack to work.

The issue scores a moderate CVSS of 4.9 and does not appear in the KEV catalog, and no EPSS data is available. Because exploitation requires authenticated access, the risk depends on the presence of Contributor accounts and the use of the Classic Editor. If those conditions exist, the risk is significant, though widespread public exploitation is unlikely at present.