¿Es seguro Complianz Gdpr?

Qué hace este plugin

• Slug: complianz-gdpr
• 1000000+ instalaciones activas

consentcookiecookie noticeGDPRprivacy

Estado de mantenimiento

• Última versión conocida: 7.5.0
• Requiere PHP: 7.4+
• PHP máximo soportado (analizado): 8.4

Vulnerabilidades conocidas

9 CVEs conocidos registrados para Complianz Gdpr.

CVE-2026-4019

The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to unauthorized data access in all versions up to, and including, 7.4.5 This is due to the REST API endpoint at /wp-json/complianz/v1/consent-area/{post_id}/{block_id} using __return_true as the permission_callback, allowing any unauthenticated user to access it. The cmplz_rest_consented_content() function retrieves a post by ID via get_post() and returns the consentedContent attribute of any complianz/consent-area block found in it, without checking if the post is published or if the user has permission to read it. This makes it possible for unauthenticated attackers to read the consent area block content from private, draft, or unpublished posts.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2025-11185

The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cmplz-accept-link shortcode in all versions up to, and including, 7.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-1592

Update the WordPress Complianz – GDPR/CCPA Cookie Consent plugin to the latest available version (at least 7.0.0). Krzysztof Zając discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Complianz – GDPR/CCPA Cookie Consent Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. This vulnerability has been fixed in version 7.0.0. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-6498

The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to and including 6.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

Complianz – GDPR/CCPA Cookie Consent [complianz-gdpr] < 6.4.5

The Complianz - GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.4.4. This is due to missing or incorrect nonce validation on the maybe_install_suggested_plugins function. This makes it possible for unauthenticated attackers to install suggested plugins via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Complianz – GDPR/CCPA Cookie Consent [complianz-gdpr] < 6.4.5

The Complianz - GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.4.4. This is due to missing or incorrect nonce validation on the ajax_script_save function. This makes it possible for unauthenticated attackers to save scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2023-33333

The Complianz plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in versions up to, and including, 6.4.4 (Free) and 6.4.6.1 (Premium). This is due to missing nonce validation on the ajax_script_add() and ajax_script_save() functions called via AJAX actions. This makes it possible for unauthenticated attackers to invoke this function and add web scripts to a site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Complianz – GDPR/CCPA Cookie Consent [complianz-gdpr] < 6.4.5

The Complianz - GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.4.4. This is due to missing or incorrect nonce validation on the cmplz_duplicate_cookiebanner function. This makes it possible for unauthenticated attackers to duplicate the compliance cookie banner via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

+ 5 vulnerabilidades conocidas más

CVE	Vulnerabilidad	Tipo	Gravedad	Afectadas	Corregido en	Publicado	Estado
—	Complianz – GDPR/CCPA Cookie Consent [complianz-gdpr] < 6.4.5	—	Desconocido	< 6.4.5	6.4.5	2023-05-12	✓ corregido en la última versión
CVE-2023-1069	Complianz – GDPR/CCPA Cookie Consent [complianz-gdpr] < 6.4.2	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 5,4	< 6.4.2	6.4.2	2023-03-06	✓ corregido en la última versión
CVE-2022-3494	Complianz – GDPR/CCPA Cookie Consent [complianz-gdpr] < 6.3.4	Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL)	Alta 8,8	< 6.3.4	6.3.4	2022-10-17	✓ corregido en la última versión
CVE-2022-0193	Complianz – GDPR/CCPA Cookie Consent [complianz-gdpr] < 6.0.0	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 6.0.0	6.0.0	2022-01-17	✓ corregido en la última versión
CVE-2026-2389	Complianz – GDPR/CCPA Cookie Consent [complianz-gdpr] < 7.4.5	—	Desconocido	< 7.4.5	7.4.5	0000-00-00	✓ corregido en la última versión

Complianz – GDPR/CCPA Cookie Consent [complianz-gdpr] < 6.4.5

The Complianz - GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.4.4. This is due to missing or incorrect nonce validation on the cmplz_delete_cookiebanner function. This makes it possible for unauthenticated attackers to delete the compliance cookie banner via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2023-1069

Update the WordPress Complianz – GDPR/CCPA Cookie Consent plugin to the latest available version (at least 6.4.2). Erwan LR (WPScan) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Complianz – GDPR/CCPA Cookie Consent Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 6.4.2.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2022-3494

The Complianz plugin for WordPress is vulnerable to SQL Injection via unescaped translations in versions up to, and including, 6.3.3 (Free) and 6.3.5 (Premium) due to insufficient escaping on the user supplied translation (either from a translation file or a user with translator role through a translation plugin) and lack of sufficient preparation on the existing SQL query. This makes it possible for attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2022-0193

The Complianz WordPress plugin before 6.0.0 does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2026-2389

The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 7.4.4.2. This is due to the `revert_divs_to_summary` function replacing `”` HTML entities with literal double-quote characters (`"`) in post content without subsequent sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected page. The Classic Editor plugin is required to be installed and activated in order to exploit this vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Cómo solucionarlo

Mantén Complianz Gdpr actualizado — 7.5.0 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• Compliance by Hu-manity.co — 900000+ instalaciones activas — 96/100 (3024) — PHP máx. 8.4
• CookieAdmin – Cookie Consent Banner — 400000+ instalaciones activas — 100/100 (4) — PHP máx. 8.4
• WP Consent API — 200000+ instalaciones activas — 100/100 (2) — PHP máx. 8.4
• TermsFeed AutoTerms: Privacy Policy Generator, Cookie Consent, GDPR, CCPA, Terms & Conditions, Disclaimers, Cookies Policy, EULA — 70000+ instalaciones activas — 94/100 (245)
• Asesor de Cookies RGPD para normativa europea — 20000+ instalaciones activas — 78/100 (59)