Complianz - GDPR/CCPA Cookie Consent < 6.4.2 - Contributor+ Stored XSS

Also known as GHSA-7j4m-f87g-5r9r

Published 3 y ago 2023-03-27 · modified 4 mo ago 2026-06-17 · JSON

CVSS

5.4

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.6%

percentile 47%

Public exploits

none known

The Complianz WordPress plugin before 6.4.2, Complianz Premium WordPress plugin before 6.4.2 do not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

CISA SSVC assessment

Exploitation: Proof of concept public
Automatable: no
Technical impact: partial
Assessed: 20 mo ago 2025-02-18

Exploit prediction (EPSS)

0.56% probability of exploitation in the next 30 days, higher than 47% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CISA ADP	3.1	5.4	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N`
NVD	3.1	5.4	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N`
CNA	3.1	5.4	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N`
GitHub	3.1	5.4	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
packagist	`really-simple-plugins/complianz-gdpr`	<6.4.2	6.4.2

Affected products

Unknown Complianz
Unknown Complianz Premium

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

wpscan.com /vulnerability/caacc50c-822e-46e9-bc0b-681349fd0dda · exploit, vdb-entry, technical-description, x_transferred
nvd.nist.gov /vuln/detail/CVE-2023-1069 · advisory
github.com /Really-Simple-Plugins/complianz-gdpr/commit/e6c2c386cadb78f8cdcded1b000cbd38bd9ff043 · web

Sources

CVE List: CVE-2023-1069
GitHub Advisory: GHSA-7j4m-f87g-5r9r
NVD: CVE-2023-1069

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary