The Complianz GDPR/CCPA Cookie Consent Banner plugin allows an unauthenticated attacker to store a malicious script in comment content, bypassing WordPress's default wp_kses sanitization. The payload exploits a filter that rewrites output, breaking out of quoted attribute contexts and enabling execution when the comment is approved. An attacker can then host arbitrary JavaScript that runs on the pages of site visitors, enabling session hijacking, data theft, or defacement.

WordPress sites running the Complianz GDPR / CCPA Cookie Consent Banner plugin versions up to and including 7.5.5 are susceptible. The vulnerability exists in all releases of the plugin before the updated version that removes the insecure filter.

The CVSS score of 7.2 reflects a high impact, and the EPSS score of < 1% indicates a low but non‑zero exploitation probability, while the lack of authentication requirements lowers the immediate exploitation barrier. The vulnerability is not yet listed in the CISA KEV catalog. Attackers can achieve cross‑site script execution by posting an approved comment, so the risk is significant for any site that allows public comments and has the yotu‑wp integration active.