Plugin vulnerabilities
Is Complianz safe? Known vulnerabilities and the version to run.
Complianz: adds a cookie consent banner and blocks tracking scripts until visitors agree.
The short answer
Run Complianz 7.5.6 or later. That version has a fix for every known vulnerability that's been patched.
- Known vulnerabilities
- 25
- In the last 12 months
- 8
- Rated high or critical
- 3
- No fix yet
- 0
Every known Complianz vulnerability
Newest first. The most recent was disclosed on 15 October 2026. Each one links to its full record on Wordfence.
| Vulnerability | Severity | Affected versions | Fixed in |
|---|---|---|---|
| Unauthenticated Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker FilterCVE-2026-97339 · 15 October 2026 | High 7.2 | 7.5.5 and earlier | 7.5.6 |
| Unauthenticated Stored Cross-Site Scripting via Elementor Cookie Blocker RegexCVE-2026-83561 · 17 September 2026 | High 7.2 | 7.5.4 and earlier | 7.5.5 |
| Authenticated (Author+) Server-Side Request ForgeryCVE-2026-65496 · 22 July 2026 | Medium 6.4 | 7.5.1 and earlier | 7.5.2 |
| Authenticated (Administrator+) PHP Object InjectionCVE-2026-65497 · 22 July 2026 | Medium 6.6 | 7.5.1 and earlier | 7.5.2 |
| Unauthenticated Information ExposureCVE-2026-65498 · 22 July 2026 | Medium 5.3 | 7.5.1 and earlier | 7.5.2 |
| Missing Authorization to Unauthenticated Private Post Content Disclosure via Consent Area REST EndpointCVE-2026-4019 · 28 April 2026 | Medium 5.3 | 7.4.5 and earlier | 7.4.6 |
| Authenticated (Contributor+) Stored Cross-Site Scripting via Content FilterCVE-2026-2389 · 25 March 2026 | Medium 4.9 | 7.4.4.2 and earlier | 7.4.5 |
| Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeCVE-2025-11185 · 17 February 2026 | Medium 6.4 | 7.4.3 and earlier | 7.4.4 |
| Cross-Site Request Forgery to Data Request DeletionCVE-2024-1592 · 1 March 2024 | Medium 4.3 | 6.5.6 and earlier | 7.0.0 |
| Authenticated(Administrator+) Stored Cross-site Scripting via settingsCVE-2023-6498 · 3 January 2024 | Medium 4.4 | 6.5.5 and earlier | 6.5.6 |
| Complianz <= 6.4.4 (Premium <= 6.4.6.1) - Cross-Site Request Forgery to Stored Cross-Site ScriptingCVE-2023-33333 · 21 June 2023 | Medium 6.1 | 6.4.4 and earlier | 6.4.5 |
| Complianz <= 6.4.5 (Premium <= 6.4.7) - Cross-Site Request ForgeryCVE-2023-34030 · 20 June 2023 | Medium 4.3 | 6.4.5 and earlier | 6.4.6 |
| Cross-Site Request ForgeryCVE-2023-34030 · 30 May 2023 | Medium 4.3 | before 6.4.6 | 6.4.6 |
| Cross-Site Request Forgery via maybe_install_suggested_pluginsCVE-2023-33333 · 12 May 2023 | Medium 4.3 | 6.4.4 and earlier | 6.4.5 |
| Cross-Site Request Forgery via ajax_script_saveCVE-2023-33333 · 12 May 2023 | Medium 6.1 | 6.4.4 and earlier | 6.4.5 |
| Cross-Site Request Forgery via ajax_create_pagesCVE-2023-33333 · 12 May 2023 | Medium 4.3 | 6.4.4 and earlier | 6.4.5 |
| Cross-Site Request Forgery via ajax_edit_itemCVE-2023-33333 · 12 May 2023 | Medium 4.3 | 6.4.4 and earlier | 6.4.5 |
| Cross-Site Request Forgery via ajax_script_addCVE-2023-33333 · 12 May 2023 | Medium 6.1 | 6.4.4 and earlier | 6.4.5 |
| Cross-Site Request Forgery via ajax_delete_snapshotCVE-2023-33333 · 12 May 2023 | Medium 5.4 | 6.4.4 and earlier | 6.4.5 |
| Cross-Site Request Forgery via run_syncCVE-2023-33333 · 12 May 2023 | Medium 4.3 | 6.4.4 and earlier | 6.4.5 |
| Cross-Site Request Forgery via cmplz_duplicate_cookiebanner12 May 2023 | Medium 4.3 | 6.4.4 and earlier | 6.4.5 |
| Cross-Site Request Forgery via cmplz_delete_cookiebanner12 May 2023 | Medium 4.3 | 6.4.4 and earlier | 6.4.5 |
| Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2023-1069 · 6 March 2023 | Medium 6.4 | 6.4.1 and earlier | 6.4.2 |
| SQL Injection via TranslationsCVE-2022-3494 · 17 October 2022 | High 8.8 | 6.3.3 and earlier | 6.3.4 |
| Reflected Cross-Site Scripting via s parameterCVE-2022-0193 · 17 January 2022 | Medium 6.1 | before 6.0.0 | 6.0.0 |
If you run Complianz
What to do now
- Check your version. In WordPress, go to Plugins and look under Complianz. Compare it with the affected versions above.
- Update to 7.5.6 or later. Take a backup first, then update. If the update breaks something, you can restore the backup while you work out why.
- Check the rest of your site. One outdated plugin is rarely the only one. Our free security check looks at your WordPress version, and the plugins and theme it can see from the outside, for known flaws and emails you a report.
Pressfort keeps your plugins up to date for you, testing each update on a copy of your site first, and its virtual patching blocks attacks on newly disclosed flaws, often before a fix is out. If your site does get hacked, two clean-ups a year are included, with a developer stepping in when needed. See how it works.
Site tools and admin
Related plugins
WPCode
Adds code snippets, tracking scripts and custom PHP to a site without editing theme files.
5 known2 in the last year
Better Search Replace
Runs search and replace across the database, often used when moving a site to a new domain.
2 known
Code Snippets
Runs custom PHP, CSS and JavaScript snippets from the dashboard instead of a theme's functions file.
10 known5 in the last year
ManageWP Worker
Connects a site to ManageWP so it can be updated and backed up from one dashboard.
4 known3 in the last year
WP File Manager
A plugin for managing your site's files from inside the WordPress dashboard.
16 known3 in the last year
MainWP Child
Connects a site to a MainWP dashboard so it can be managed alongside others.
9 known2 in the last year
Data sources and licences
Vulnerability data comes from Wordfence Intelligence and is refreshed daily. Severity is the CVSS score given in each record. Pressfort is not affiliated with Wordfence or Defiant Inc.
Copyright 2012-2026 Defiant Inc.
Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.
https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/
Copyright 1999-2026 The MITRE Corporation
CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.
Not sure yet?
Find out how exposed your site is.
Send us your site address and get a free, plain-English report of what we find. We check from the outside, so there are no logins to hand over and nothing to install.
- Known vulnerability in 1 pluginGallery plugin, file upload flawUrgent
- WordPress is out of dateRunning 6.7.1, latest is 6.8.3To fix
- 6 plugins and 1 theme out of dateOldest is 14 months behindTo fix