CVE-2026-107631 davidevalerio CVE debrief

Who should care

Defenders responsible for WordPress installations using the Record of Consent Extension for Complianz plugin, version 2.5 or earlier, should assess potential exposure and prioritize verification and remediation efforts.

Why it matters

CVE-2026-107631 is a Stored Cross-Site Scripting vulnerability in the Record of Consent Extension for Complianz plugin for WordPress. Defenders should prioritize verifying exposure and assessing potential impact.

• Unauthenticated stored cross-site scripting attacks may inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
• Defenders should verify exposure of WordPress installations using the Record of Consent Extension for Complianz plugin, version 2.5 or earlier.
• Remediation priority follows from verifying exposure and assessing potential impact.

Technical summary

The Record of Consent Extension for Complianz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'uid' parameter in all versions up to, and including, 2.5. This is possible because the enforcing nonce is emitted via wp_localize_script on wp_enqueue_scripts and is therefore readable by any unauthenticated frontend visitor, and no capability or role check gates the write path.

Defensive priority

Defenders should prioritize verifying exposure of WordPress installations using the Record of Consent Extension for Complianz plugin, version 2.5 or earlier, and assess the potential for unauthenticated stored cross-site scripting attacks.

Recommended defensive actions

• Verify WordPress installations using the Record of Consent Extension for Complianz plugin, version 2.5 or earlier, to assess potential exposure.
• Review and update the plugin to a version beyond 2.5 if possible.
• Monitor for potential unauthenticated stored cross-site scripting attacks targeting the 'uid' parameter.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability, including the affected versions and parameters. However, there is limited information on potential exploits or victim impact. Defenders should verify the exposure of WordPress installations using the Record of Consent Extension for Complianz plugin, version 2.5 or earlier, and assess the potential for unauthenticated stored cross-site scripting attacks. The CVE record was published on 2026-10-14T07:43:34.674Z and has not been modified since then. There are references

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.