Complianz WordPress plugin vulnerable to cross-site scripting

MEDIUM 5.4CVE-2023-1069 · GHSA-7j4m-f87g-5r9r · Published 27/03/2023 · updated 17/06/2026

In short

CVE-2023-1069 is a MEDIUM (CVSS 5.4) vulnerability affecting really-simple-plugins/complianz-gdpr, complianz (really-simple-plugins).
Chance of exploitation in the next 30 days (EPSS): 0.56%, higher than 46.5% of all vulnerabilities.
Fix: update to 6.4.2 or later.

Package	Affected versions	Patched versions
really-simple-plugins/complianz-gdpr Packagist	`< 6.4.2`	`6.4.2`
complianz really-simple-plugins	`< 6.4.2`	`6.4.2`

Description

The Complianz Premium WordPress plugin before 6.4.2 did not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

NVD description

The Complianz WordPress plugin before 6.4.2, Complianz Premium WordPress plugin before 6.4.2 do not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

References

nvd.nist.gov/vuln/detail/CVE-2023-1069 · ADVISORY
Really-Simple-Plugins/complianz-gdpr commit e6c2c38 · WEB
wpscan.com/vulnerability/caacc50c-822e-46e9-bc0b-681349fd0dda · WEB
www.github.com/Really-Simple-Plugins/complianz-gdpr · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

really-simple-plugins/complianz-gdpr

Packagist

< 6.4.2

6.4.2

complianz

really-simple-plugins

< 6.4.2

6.4.2

Description

NVD description