CVE-2025-11185: Complianz WordPress Plugin XSS Vulnerability

CVE-2025-11185 Overview

The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the cmplz-accept-link shortcode. All versions up to and including 7.4.3 are affected due to insufficient input sanitization and output escaping on user-supplied attributes. This vulnerability allows authenticated attackers with contributor-level access or above to inject arbitrary web scripts into pages that execute whenever any user accesses the compromised page.

Critical Impact

Authenticated attackers can inject persistent malicious JavaScript that executes in visitors' browsers, potentially leading to session hijacking, credential theft, or malware distribution on WordPress sites using this popular GDPR compliance plugin.

Affected Products

• Complianz – GDPR/CCPA Cookie Consent plugin for WordPress versions up to and including 7.4.3
• WordPress installations using vulnerable Complianz plugin versions
• Websites relying on Complianz shortcodes for cookie consent functionality

Discovery Timeline

• 2026-02-18 - CVE CVE-2025-11185 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2025-11185

Vulnerability Analysis

This Stored Cross-Site Scripting (XSS) vulnerability (CWE-79) resides in the Complianz plugin's shortcode handling mechanism, specifically within the cmplz-accept-link shortcode implementation. The vulnerability stems from the plugin's failure to properly sanitize and escape user-supplied attribute values before rendering them in HTML output.

When a user with contributor-level privileges or higher creates or edits content containing the vulnerable shortcode, they can inject malicious attribute values that bypass the plugin's input validation. These malicious scripts are stored in the WordPress database and subsequently executed in the browsers of all users who view the affected page.

The attack requires authentication with at least contributor-level access, which limits the attack surface but does not eliminate the risk. Contributors on multi-author WordPress sites, compromised contributor accounts, or malicious insiders can all leverage this vulnerability to execute persistent XSS attacks affecting all site visitors.

Root Cause

The root cause lies in the class-document.php file within the Complianz plugin, where shortcode attribute processing occurs. The vulnerability is caused by insufficient input sanitization when processing user-supplied attributes in the cmplz-accept-link shortcode handler. The plugin fails to adequately escape output before rendering it in the HTML context, allowing JavaScript code embedded in attribute values to be executed by visitors' browsers.

Attack Vector

The attack is network-based and requires an authenticated attacker with at least contributor-level WordPress privileges. The attacker crafts a malicious shortcode containing JavaScript payloads within attribute values and embeds it in a WordPress page or post.

Once the content is published or saved for preview, the malicious script persists in the database. When any user—including administrators—views the page, the injected JavaScript executes in their browser context. This can lead to session cookie theft, phishing overlay injection, keylogging, or redirection to malicious sites.

The vulnerability does not require user interaction beyond normal page viewing, and the changed scope (S:C in the CVSS vector) indicates that the attack can affect resources beyond the vulnerable component's security scope.

Detection Methods for CVE-2025-11185

Indicators of Compromise

• Unusual JavaScript code or encoded scripts within WordPress post/page content containing cmplz-accept-link shortcodes
• Unexpected <script> tags or event handlers (e.g., onerror, onload, onclick) in shortcode attributes
• Modified content in the wp_posts table containing obfuscated or suspicious JavaScript payloads
• Browser console errors or unexpected network requests originating from pages using Complianz shortcodes

Detection Strategies

• Review WordPress content for anomalous shortcode usage, particularly cmplz-accept-link shortcodes with unusual attribute values
• Deploy Web Application Firewalls (WAF) with XSS detection rules to identify malicious script injection attempts
• Monitor WordPress database tables for content containing JavaScript event handlers or <script> tags within shortcode syntax
• Implement Content Security Policy (CSP) headers to detect and report inline script execution violations

Monitoring Recommendations

• Enable comprehensive WordPress audit logging to track all content modifications by contributor-level users and above
• Configure real-time alerting for content changes involving Complianz shortcodes
• Implement browser-based monitoring for unexpected script execution or DOM modifications on pages using the Complianz plugin
• Review user activity logs for contributors making bulk or suspicious content modifications

How to Mitigate CVE-2025-11185

Immediate Actions Required

• Update the Complianz – GDPR/CCPA Cookie Consent plugin to version 7.4.4 or later immediately
• Audit all existing WordPress content for potentially malicious shortcode attributes in cmplz-accept-link usage
• Review and restrict contributor-level access where possible until the patch is applied
• Implement Content Security Policy headers to mitigate the impact of any existing injected scripts

Patch Information

The vulnerability affects all Complianz plugin versions up to and including 7.4.3. Site administrators should update to the latest patched version available through the WordPress plugin repository. Technical details regarding the vulnerable code can be reviewed at the WordPress Plugin Document Code and the Wordfence Vulnerability Analysis for additional context.

Workarounds

• Restrict WordPress user roles to limit the number of users with contributor-level access or above until patching is complete
• Implement a Web Application Firewall (WAF) with XSS filtering rules to block malicious shortcode attribute injection attempts
• Temporarily disable or remove the Complianz plugin if it is not critical to site operations and an immediate update is not possible
• Deploy strict Content Security Policy headers to prevent inline script execution as a defense-in-depth measure

# WordPress CLI command to update the Complianz plugin
wp plugin update complianz-gdpr --force

# Verify the installed plugin version after update
wp plugin get complianz-gdpr --field=version