Record of Consent Extension for Complianz <= 2.5 - Unauthenticated Stored Cross-Site Scripting via 'uid' Parameter

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-107631 · Microsoft / collected KEV context

cve-program · CVE-2026-107631

• https://www.wordfence.com/threat-intel/vulnerabilities/id/8f56e7de-5a85-4b99-95d3-596af7694394?source=cve
• https://plugins.trac.wordpress.org/browser/record-of-consent-extension-for-complianz/tags/2.5/js/admin.js#L701
• https://plugins.trac.wordpress.org/browser/record-of-consent-extension-for-complianz/tags/2.5/includes/class-rocext-consent-handler.php#L105
• https://plugins.trac.wordpress.org/browser/record-of-consent-extension-for-complianz/tags/2.5/includes/class-rocext-consent-handler.php#L289
• https://plugins.trac.wordpress.org/browser/record-of-consent-extension-for-complianz/tags/2.5/includes/admin-tab-records.php#L643
• https://wordpress.org/plugins/record-of-consent-extension-for-complianz/
• https://plugins.trac.wordpress.org/changeset?reponame=&new=3736545%40record-of-consent-extension-for-complianz%2Ftags%2F2.6&old=3736488%40record-of-consent-extension-for-complianz%2Ftags%2F2.5

No related operational record is retained in the current change model.