CVE-2026-107631

7.2High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.2High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-79

Impact

Unauthenticated attackers can inject persistent malicious scripts that execute in the browser of anyone viewing the stored consent records, including administrators. The attacker only needs network access to the WordPress site to send the payload.

Root cause

The write endpoint lacks role checks, exposes its security nonce to unauthenticated visitors via the frontend, and fails to sanitize or escape the 'uid' parameter.

Affected systems

Record of Consent Extension for Complianz plugin for WordPress up to and including version 2.5

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Fix & remediation

Upgrade Record of Consent Extension for Complianz to version 2.6 or later. If patching immediately is not possible, deactivate and uninstall the plugin.

shell

$ wp plugin update record-of-consent-extension-for-complianz

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

The Record of Consent Extension for Complianz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'uid' parameter in all versions up to, and including, 2.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the enforcing nonce is emitted via wp_localize_script on wp_enqueue_scripts and is therefore readable by any unauthenticated frontend visitor, and no capability or role check gates the write path.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-107631