CVE-2026-97339

Executive Summary

CVE-2026-97339 is a stored cross-site scripting (XSS) vulnerability in the Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress, affecting all versions up to and including 7.5.5. An unauthenticated attacker can inject arbitrary web scripts through WordPress comment content that bypasses the platform's standard wp_kses comment sanitization, with execution triggered by the plugin's own output-buffer filtering. Because the injected script runs in the context of the affected site whenever a visitor loads the poisoned page, the vulnerability enables session theft, content manipulation, and broader client-side compromise.

Technical Analysis

The vulnerability resides in the interaction between Complianz's cookie-blocker output filter and WordPress's native comment sanitization pipeline. WordPress routes submitted comment content through wp_kses, which strips disallowed tags and attributes while permitting a curated allow-list of safe HTML. Under normal conditions this prevents stored XSS in comment fields.

CVE-2026-97339 bypasses this protection through a two-stage mechanism:

1. Sanitizer evasion at input. The attacker's payload is constructed using only allow-listed HTML tags, and the executable JavaScript tokens are placed inside quoted attribute values where they are treated as plain text. Because wp_kses parses these tokens as inert attribute string content rather than executable markup, the sanitizer does not flag or strip them.

2. Context breakout at output. Complianz's own output-buffer filter processes rendered page content and performs str_replace() rewrites (referenced in the NVD description as the "yotu-wp Cookie-Blocker Filter" mechanism). These rewrites are not context-aware: when the filter performs its string substitution, the previously inert attribute-embedded tokens are transformed into executable script content, breaking out of the attribute context in which they were originally confined.

The critical condition is that the XSS is only realized when Complianz's filter rewrites the content — the raw stored comment is benign until the plugin's post-processing runs. This means the flaw is fundamentally a sanitization/escaping mismatch between two independent components (WordPress core sanitization and a third-party output filter), a recurring class of WordPress plugin vulnerabilities where trust boundaries between validation and rendering are misaligned.

Attack vector details per the CVSS vector (AV:N/AC:L/PR:N/UI:N): network-exploitable, low complexity, requiring no authentication and no user interaction to inject. The description notes the comment must be approved before it executes for visitors — an approval gate that constrains (but does not eliminate) the attack, since many WordPress deployments auto-approve comments from previously-approved commenters, or administrators may approve without inspecting the raw markup for filter-triggered execution.

Scope is marked S:C (Changed), reflecting that a compromise of the vulnerable plugin's processing context can affect resources beyond the immediate component — here, the integrity and confidentiality of the hosting page's entire client-side execution environment. Confidentiality and Integrity impacts are rated Low (C:L/I:L) in the CVSS vector, and there is no Availability impact.

Associated CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation — 'Cross-site Scripting'). The specific sub-pattern is a stored XSS that survives an intermediate sanitizer due to differential parsing behavior between the sanitizer and a downstream string-rewriting filter.

Exploitation Scenarios

The following attack chain is derived strictly from the NVD description. The vulnerability class (stored XSS via sanitizer-bypass and context-breakout) is well understood; no public proof-of-concept exists for this specific CVE, so the chain is described at the vulnerability-class level. No specific function names, endpoints, or parameter names beyond those appearing in the source description are asserted.

1. Reconnaissance / target identification. The attacker identifies a WordPress site running the Complianz GDPR/CCPA Cookie Consent Banner plugin at version 7.5.5 or earlier. Plugin presence is typically fingerprintable from publicly served front-end assets and markup (wp-content/plugins/complianz-gdpr paths in page source). The target must expose a functional comment submission form.

2. Triggering the flaw class. The attacker submits a comment whose body contains HTML composed solely of allow-listed tags, with the executable tokens embedded as plain text inside quoted attribute values. This construction is designed to pass wp_kses because the dangerous content is not recognized as script markup at input time. No authentication is required to submit the comment (PR:N); the attacker submits as an anonymous visitor.

3. Payload/execution method (class-level). The comment is stored. When the WordPress comment is later rendered into a page and Complianz's output-buffer filter runs its str_replace() rewrites over that content, the substitution mutates the stored markup so that the previously inert attribute-embedded tokens emerge as executable script content, escaping the attribute context. At this point the payload is a live script in the page's HTML. Prerequisite: the comment must be approved by a moderator/admin before it is served to other visitors. Once approved, the script executes in the browser of any visitor who loads the affected page.

4. Post-exploitation impact. With arbitrary script execution in the origin's context, an attacker can act on behalf of victims within the site origin — including reading accessible page content, issuing authenticated requests as the victim, exfiltrating cookies or tokens reachable from client-side scripts, injecting phishing or consent-banner spoofing content, and redirecting or manipulating user interactions. Because it is server-stored, every visitor to the injected page is affected — a classic stored XSS blast radius (S:C, network-wide, no interaction needed at execution time).

Impact Assessment

• Business impact. A stored XSS on a public-facing WordPress site can be leveraged for credential/session theft, drive-by malware or phishing delivery, defacement via injected banners, and reputational damage. It affects all site visitors who load the injected page after comment approval, including authenticated administrators browsing the front end — a common privilege-escalation path to full site compromise.
• Affected systems. Any WordPress deployment hosting Complianz GDPR/CCPA Cookie Consent Banner ≤ 7.5.5. Scope is broad because the plugin is widely deployed across EU/CCPA-regulated sites.
• CVSS subscores (7.2 High). AV:N remote; AC:L low attack complexity; PR:N no privileges required; UI:N no user interaction at execution; S:C scope changed; C:L/I:L limited confidentiality and integrity impact; A:N no availability impact. The High base score reflects unauthenticated remote reachability with changed scope despite limited per-instance C/I impact.
• Blast radius. Every page that renders an approved, poisoned comment while the Complianz filter is active. The stored nature makes this persistent and self-propagating to all viewers.
• Constraints. Exploitation requires comment approval, which moderates but does not prevent the attack. No public exploit or Nuclei template exists at time of writing, lowering immediate mass-exploitation risk, but the technique is reproducible by a competent attacker.

Detection Guidance

Sigma Rule

title: Complianz Cookie-Blocker Stored XSS via Comment Content (CVE-2026-97339)
id: 8f4e2c1a-9b7d-4e3f-a1c2-5d6e7f8a9b0c
status: experimental
description: Detects comment submissions containing allow-listed HTML with executable tokens hidden inside quoted attribute values, indicative of the CVE-2026-97339 sanitizer-bypass payload.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-97339
author: valtersit.com
date: 2026-01-01
logsource:
  product: wordpress
  service: comment
detection:
  selection_submission:
    event_type: 'comment_submission'
  selection_suspicious:
    comment_content|contains:
      - 'str_replace'
      - '<a '
      - '<span '
      - 'onmouseover'
      - 'onerror'
      - 'javascript:'
    comment_content|re: '[a-zA-Z]+="[^"]*[<>()\'";]+[^"]*"'
  condition: selection_submission and selection_suspicious
falsepositives:
  - Legitimate comments quoting HTML attributes
  - Security researchers submitting benign test content
level: medium
tags:
  - attack.t1190
  - cve.2026.97339

YARA Rule

rule CVE_2026_97339_Complianz_Stored_XSS
{
    meta:
        description = "Detects stored XSS payloads targeting Complianz cookie-blocker output filter (CVE-2026-97339)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-97339"
        cve = "CVE-2026-97339"
    strings:
        $c1 = "complianz" nocase
        $t1 = "onerror=" nocase
        $t2 = "onmouseover=" nocase
        $t3 = "javascript:" nocase
        $attr = /[a-zA-Z_:-]+="[^"]{0,40}[<>&]#?[^"]{0,40}"/
    condition:
        ($c1 and any of ($t*)) or ($t1 and $attr) or ($t2 and $attr) or ($t3 and $attr)
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-97339 Complianz GDPR Stored XSS Comment Injection Attempt"; flow:established,to_server; content:"POST"; http_method; content:"comment"; http_uri; nocase; content:"onerror"; http_client_body; nocase; content:"onmouseover"; http_client_body; nocase; pcre:"/[a-zA-Z]+=\x22[^\x22]*[<>]\x22/i"; reference:cve,2026-97339; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-97339; classtype:web-application-attack; sid:202697339; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [any where event.category == "web" and http.request.method == "POST" and
     wildcard(http.request.body, "*onerror*") and wildcard(http.request.body, "*comment*")]
  [any where event.category == "web" and
     wildcard(http.request.body, "*onmouseover*") or wildcard(http.request.body, "*javascript:*")]

Splunk SPL Query

index=web sourcetype=access_combined
| search (uri_path="*wp-comments-post*" OR uri_path="*comment*") method=POST
| eval body=coalesce(form_data, request_body, "")
| where (match(lower(body), "onerror|onmouseover|javascript:|<script")) AND match(body, "[A-Za-z_:-]+=\"[^\"]*[<>]")
| stats count min(_time) as first_seen max(_time) as last_seen values(clientip) as sources by uri_path, status
| sort - count

Wazuh OSSEC Rule

<group name="web,wordpress,cve-2026-97339,">
  <rule id="20269739" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <if_sid>31100</if_sid>
    <url>wp-comments-post</url>
    <description>CVE-2026-97339: Possible Complianz stored XSS comment injection attempt</description>
    <regex type="pcre2">(?i)(onerror=|onmouseover=|javascript:)</regex>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_97339,xss,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims a patch; not independently confirmed by a vendor advisory).

1. Immediate mitigations (no confirmed patch available):

   • Disable comments entirely on affected sites (Settings → Discussion → Allow people to submit comments off) until compliant versions are available.
   • Enable strict comment moderation and disable auto-approval of anonymous comments; manually inspect all comments for allow-listed-tag payloads with attribute-embedded tokens before approval.
   • Restrict comment submission where not required by the business; consider disabling the comment form site-wide on regulated properties.
   • Apply a Web Application Firewall (WAF) rule blocking comment bodies containing event-handler tokens (onerror, onmouseover) or executable URI schemes (javascript:) embedded in quoted attributes.
   • If comments are essential and the plugin is not required for compliance on a given site, temporarily deactivate the Complianz plugin.

2. Patch / upgrade steps:

   • Monitor the vendor (Complianz) and the NVD record for a confirmed fixed version. The vulnerability affects all versions ≤ 7.5.5 inclusive; upgrade immediately once a patched release is published and verify the changelog documents the XSS fix. Do not assume a patch exists based on the single unconfirmed source.
   • After upgrading, re-audit existing stored comments for previously injected payloads and remove any that exhibit the differential-parsing pattern.

3. Long-term hardening:

   • Enforce context-aware output escaping in custom output-buffer filters — avoid str_replace()-based rewriting of page content, which is not context-aware and breaks sanitization guarantees.
   • Maintain a WordPress hardening baseline: least-privilege admin roles, comment moderation, timely core/plugin updates, and integrity/file-integrity monitoring.
   • Add CSP (Content-Security-Policy) headers to reduce XSS impact as defense in depth.

References

1. NVD — CVE-2026-97339: https://nvd.nist.gov/vuln/detail/CVE-2026-97339
2. CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
3. Complianz plugin project page (WordPress.org): https://wordpress.org/plugins/complianz-gdpr/
4. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. CISA Known Exploited Vulnerabilities Catalog (current status: not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild status: No public proof-of-concept, exploit code, or Nuclei template is available at time of writing. CVE-2026-97339 is not listed in CISA KEV, and no threat actor campaigns have been associated with it. EPSS has not yet been scored by FIRST.org. The exploitation technique (allow-listed-tag injection with attribute-embedded executable tokens that survive wp_kses and detonate via str_replace() output rewrites) is novel and component-interaction-dependent, which currently limits automated mass-exploitation.