CVE-2026-107631

Executive Summary

CVE-2026-107631 is a stored cross-site scripting (XSS) vulnerability in the Record of Consent Extension for the Complianz WordPress plugin, affecting all versions up to and including 2.5. The flaw resides in the uid parameter, which is written without sufficient input sanitization and rendered without output escaping. Because the nonce protecting the write path is exposed to unauthenticated visitors via wp_localize_script on wp_enqueue_scripts and no capability or role check gates the write, an unauthenticated attacker can persistently inject arbitrary JavaScript that executes in the browser of any user viewing the injected page. With a CVSS base score of 7.2 and a scope change, this represents a significant risk to any WordPress site running the affected plugin.

Technical Analysis

The vulnerability is a classic stored (persistent) cross-site scripting condition mapped to CWE-79. The vulnerable component is the Record of Consent Extension for the Complianz WordPress plugin, versions <= 2.5.

Two distinct control failures combine to make this exploitable by unauthenticated actors:

1. Missing authorization on the write path. The NVD description states that "no capability or role check gates the write path." In WordPress terms, this means the routine that persists the attacker-supplied uid value does not verify that the caller holds a privileged capability (for example, an administrative or consent-management capability). Consequently, an unauthenticated frontend visitor can reach the write logic.

2. Exposed CSRF nonce. WordPress commonly protects state-changing requests with nonces, but a nonce is only a meaningful barrier if it is not disclosed to untrusted parties. Here, the enforcing nonce "is emitted via wp_localize_script on wp_enqueue_scripts and is therefore readable by any unauthenticated frontend visitor." Because wp_enqueue_scripts loads on the frontend and wp_localize_script outputs data into the page for JavaScript consumption, the nonce value is embedded in publicly served HTML. Any unauthenticated user can retrieve it and replay a valid request — the nonce provides no meaningful protection.

3. Insufficient sanitization and escaping. The uid parameter is neither sanitized on input nor escaped on output. Attacker-controlled content supplied to uid is therefore stored and later rendered into a page without encoding, allowing script markup to be interpreted by the browser rather than displayed as text.

The attack surface is the public-facing WordPress site hosting the affected plugin. No authentication, no user interaction (other than a victim viewing the injected page), and no special network position are required — consistent with the CVSS vector AV:N/AC:L/PR:N/UI:N. The scope change (S:C) reflects that the injected script executes in the context of the affected site's origin and can affect resources beyond the vulnerable component itself (for example, other users' sessions and other site functionality sharing that origin).

Insufficient technical detail is available in the source data regarding exact parameter routing, handler names, database storage location, or rendering template. The analysis above is limited strictly to the mechanisms described.

Exploitation Scenarios

No public PoC, Nuclei template, or exploit code is available as of this report. The attack chain below is inferred from the vulnerability class and the mechanism described in the NVD description; it does not rely on fabricated function or endpoint names.

1. Reconnaissance / target identification. An attacker identifies WordPress sites running the Record of Consent Extension for Complianz at version 2.5 or earlier. Public Shodan or web-spider enumeration of plugin assets (for example, paths under /wp-content/plugins/complianz) can reveal candidate installations. The attacker does not need credentials.

2. Triggering the flaw. The attacker loads a page of the target site as an unauthenticated frontend visitor. Because the enforcing nonce is emitted via wp_localize_script on wp_enqueue_scripts, the nonce value is present in the delivered page source and can be extracted client-side or with a simple scripted request. The attacker then submits a crafted request to the consent-recording write path, supplying a malicious value in the uid parameter and including the harvested nonce so the request is accepted.

3. Payload / execution method (class level). The uid value is stored without sanitization. Because the value is later output without escaping, script content embedded in uid is persisted and rendered into the page. When any user — including an administrator or other authenticated user — subsequently loads the affected page, the injected script executes in that user's browser within the site's origin. Any valid XSS payload construction typical of this class (for example, script markup that runs on page load) applies.

4. Post-exploitation impact. Executed script runs with the privileges and origin of the viewing user. A stored XSS in a WordPress context can be leveraged to perform actions as the victim (including privileged users), exfiltrate session or form data visible to that page, inject further content, or pivot to administrative functionality. The scope change in the CVSS vector reflects the potential to affect resources beyond the originally vulnerable component.

Because exploitation requires only a public-facing request and no authentication, the barrier to entry is low. The primary constraints are that the target must run the affected plugin version and that the injected page must be visited by a victim for the stored payload to fire.

Impact Assessment

CVSS 3.1 base score: 7.2 (High) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N.

• Attack Vector (N): Exploitable over the network against a public-facing WordPress site.
• Attack Complexity (L): No specialized conditions or race conditions; the nonce is publicly exposed, removing the usual request-forgery obstacle.
• Privileges Required (N): None — unauthenticated attackers can reach the write path.
• User Interaction (N): No deliberate victim action beyond loading the page on which the stored payload lives.
• Scope (C): Impact crosses a security boundary; script executes in the site origin and can affect resources beyond the vulnerable component.
• Confidentiality (L): Limited — script can read data exposed to the victim's browsing context.
• Integrity (L): Limited — attacker can modify content and perform actions within the victim's session context.
• Availability (N): No direct availability impact.

Blast radius. Any WordPress installation running the Record of Consent Extension for Complianz at version 2.5 or earlier with the affected frontend functionality enabled. Because the injection is stored, the payload affects every visitor to the page where it is rendered — including administrators — which raises the practical severity above what the confidentiality/integrity "Low" subscores alone suggest. Stored XSS in an administrative browsing context is a common stepping stone to full site compromise.

Exploitation likelihood. EPSS is 0.00315 (22.7th percentile of exploited CVEs), indicating low near-term predicted exploitation activity. There is no CISA KEV listing, no public PoC, and no Nuclei template. The vulnerability is unpatched as of this report, so exposure persists for sites that do not mitigate.

Detection Guidance

Sigma Rule

title: Stored XSS via uid Parameter - Complianz Record of Consent Extension (CVE-2026-107631)
id: 8f3c1d2a-7b64-4e21-9a0d-cve2026107631
status: experimental
description: Detects suspicious requests targeting the Record of Consent write path with script-like content in the uid parameter.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-107631
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'POST'
  selection_uri:
    cs-uri-query|contains:
      - 'uid='
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - '%3Cscript'
      - 'javascript:'
      - 'onerror='
      - 'onload='
      - '<svg'
      - 'document.cookie'
  condition: selection_method and selection_uri and selection_payload
falsepositives:
  - Legitimate applications that legitimately submit markup-like values in uid fields
level: high
tags:
  - attack.t1190
  - cwe.cwe-79

YARA Rule

rule CVE_2026_107631_Complianz_RecordOfConsent_XSS
{
    meta:
        description = "Detects stored XSS payload indicators in the uid parameter of the Complianz Record of Consent extension (CVE-2026-107631)"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-107631"
        date = "2026-01-01"
        severity = "high"

    strings:
        $uid = "uid=" ascii nocase
        $s1 = "<script" ascii nocase
        $s2 = "javascript:" ascii nocase
        $s3 = "onerror=" ascii nocase
        $s4 = "onload=" ascii nocase
        $s5 = "document.cookie" ascii nocase
        $s6 = "<svg" ascii nocase
        $s7 = "</script>" ascii nocase
        $enc1 = "%3Cscript" ascii nocase
        $enc2 = "%3C%2Fscript%3E" ascii nocase

    condition:
        $uid and 1 of ($s*) or 1 of ($enc*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-107631 Complianz Record of Consent Stored XSS attempt via uid parameter"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"uid="; nocase; http.uri; content:"<script"; nocase; http.uri; content:"%3Cscript"; nocase; pcre:"/(uid=)[^&\s]*(%3C|<)script/i"; classtype:web-application-attack; reference:cve,2026-107631; sid:2026107631; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [network where http.request.method == "POST" and url.query : "uid=*"]
  [network where url.query : ("*<script*" or "*%3Cscript*" or "*javascript:*" or "*onerror=*" or "*document.cookie*")]

Splunk SPL Query

index=web sourcetype=access_combined
| search method=POST uri_query="*uid=*"
| eval payload=lower(uri_query)
| where match(payload, "(<script|%3cscript|javascript:|onerror=|onload=|<svg|document\.cookie)")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as target_uri by src_ip, uri_query
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,cve-2026-107631,">
  <rule id="202617631" level="12">
    <if_sid>31100</if_sid>
    <match>uid=</match>
    <regex type="pcre2">(<script|%3Cscript|javascript:|onerror=|onload=|<svg|document\.cookie)</regex>
    <description>CVE-2026-107631: Possible stored XSS attempt against Complianz Record of Consent extension via uid parameter</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_107631,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source. No affected-version fix, vendor fix reference, or workaround is provided in the source data.

1. Immediate mitigations

   • Disable or remove the Record of Consent Extension for Complianz until a fixed release is available, if the functionality is non-essential.
   • If the plugin must remain enabled, place the write path behind a WAF rule that rejects requests carrying script-like content in the uid parameter (see detection rules above).
   • Apply generic input validation at the edge: block or sanitize <, >, ", and script-related tokens in uid values arriving from unauthenticated clients.
   • Restrict administrative browsing where possible and enforce a strict Content Security Policy to reduce the impact of any stored script execution.
   • Recognise that the CSRF nonce is publicly exposed on the frontend, so it cannot be relied upon as a security control for this write path.

2. Patch/upgrade steps

   • Monitor the Complianz vendor channels and the WordPress plugin repository for a release exceeding version 2.5 that remediates CVE-2026-107631.
   • As of this report, no patched version is identified and no patch source is tracked. Do not assume any current version is fixed. Verify the fix directly against the vendor advisory once published.
   • After a fixed version is released, upgrade promptly, then review site content and consent records for previously injected payloads.

3. Long-term hardening

   • Enforce server-side authorization (capability/role checks) on all write paths in WordPress plugins, including those reachable from the frontend.
   • Treat nonces as CSRF protection only — never as authorization — and ensure they are not exposed to unauthenticated parties in a way that makes them replayable.
   • Apply context-appropriate output escaping on all rendered data and sanitization on all input, per WordPress coding standards.
   • Deploy a Content Security Policy and keep an inventory of installed plugins with version tracking to quickly identify exposure to unpatched CVEs.
   • Continuously monitor NVD, the WordPress vulnerability database, and vendor advisories for patch availability.

References

• NVD — CVE-2026-107631: https://nvd.nist.gov/vuln/detail/CVE-2026-107631
• CWE-79, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• WordPress Plugin Security / Hardening guidance: https://developer.wordpress.org/plugins/security/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-107631 NOT listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• EPSS score data (0.00315, 22.7th percentile): https://www.first.org/epss/

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-107631 in the provided data. No public PoC, Nuclei template, or exploit code is known; CISA KEV listing: NO.