Every recorded version, newest first, with what changed in each one.
Latest 7.6.715 versions
Undated · 15 versions
7.6.7
Latest
1 improvement16 fixes1 security1 change
Improved
TCF updated to IAB Policies v5.0.b: Features, Special features and Special purposes are shown as the policy requires, the TC String reports the service-specific scope, and legitimate interest is no longer set for vendors that only declare special purposes.
Fixed
TCF consent banner no longer breaks when the vendor list files fail to load, and language files stuck on an outdated vendor list are now refreshed.
TCF returning visitors' saved vendor choices are no longer replaced by "accept all" when the page loads, and the vendor checkboxes on the Cookie Policy page match the consent after accepting.
TCF vendor choices were not saved on the vendor list page when an Additional Consent provider id was above 65535.
TCF vendors kept their consent in the TC String after the cookie policy changed and the banner revoked consent.
On sites with A/B testing or more than one consent type, the cookie banner briefly appeared unstyled with an oversized close icon, because its stylesheet was only fetched after the banner script ran.
The cookie banner stylesheet URL in the page source kept its unresolved {banner_id} and {type} placeholders, which search engines reported as a 404. On sites without A/B testing and with a single consent type, the URL is now resolved server-side. Code filtering css_file through cmplz_cookiebanner_settings should no longer assume it contains placeholders.
With Google Site Kit inserting the Tag Manager container, Complianz added a second, empty Tag Manager container to the page. With Consent Mode enabled the signals are now printed in the header, before Site Kit's container, instead of in the footer.
On sites upgraded from before 7.0, a placeholder switched off on the old Integrations page could not be switched back on for services with a dash in their name, such as Google Maps: Integrations > Services reported the placeholder as enabled while the content was blocked with no placeholder at all, and the toggle had no effect. The setting is now reported accurately and can be changed again from Integrations > Services.
Switching a placeholder on or off now takes effect on the front end immediately, instead of after up to 30 minutes.
The cookie banner no longer fails to show after a cookie policy change on sites with a page cache, which left visitors without a banner and with all consent denied.
On locked premium settings, the upgrade link text no longer showed raw placeholder tokens.
On some setups, the cookie banner and script blocking could be silently absent because the cookie-warning check ran before other plugins' filters were registered.
The "accept service" button label showed a raw {Service} placeholder in some German translations.
The accessible name of the placeholder buttons now includes their visible text (WCAG 2.5.3).
The data request endpoint reported requests as successful and sent confirmation mail even when the request failed to save, including on installs where its database table didn't exist yet; it also stayed active on sites not using the feature.
Google Analytics 4 sent the first page view of a returning visitor as unconsented. Consent Mode now waits up to 500 ms for the saved consent, adjustable with the cmplz_gtag_wait_for_update filter.
Security
Fixed a Stored Cross-Site Scripting vulnerability in the YotuWP cookie blocker.
Changes
October 19th, 2026
7.6.6
12 fixes2 security1 change
Fixed
Website Scan now recovers from a token error state instead of staying stuck.
Vendor links in the TCF vendor list no longer contain unresolved placeholders, which caused broken links and crawl errors on Cookie Policy pages. Vendors without a privacy policy or legitimate interest claim URL no longer show a link at all.
The US vendor list on the US Cookie Policy renders its signatories again.
Vimeo placeholder thumbnails now use HTTPS for the oEmbed request and cache failed lookups, preventing repeated requests on every page load.
On sites with a non-English default language, strings were registered with WPML as English, making them untranslatable.
Corrected the "Dismiss on scroll" tooltip and limited dismiss on scroll and dismiss on timeout to opt-out banners, where they actually apply.
Only the first [cmplz-manage-consent] shortcode on a page was initialized, leaving the other ones empty with a "without javascript support" notice.
Cookie Policy page detection now matches the configured page, including translated pages.
The cookie banner no longer stays dismissed site-wide when the [cmplz-manage-consent] shortcode is used outside the Cookie Policy page.
On sites using more than one consent type, the Manage consent button referenced the wrong cookie banner in its aria-controls attribute.
With the soft cookie wall enabled, a page using the consent shortcodes could stay unclickable with no banner visible.
On sites with multiple cookie banners, all banners registered their WPML strings under the same names, so one banner's texts overwrote another's. Translations that were shared between banners are marked as needing an update in WPML String Translation.
Security
Rate-limited the public data request endpoint and removed an email enumeration oracle.
Fixed a Stored XSS vulnerability in the Document block.
Changes
September 30th, 2026
7.6.5
2 fixes3 security1 change
Fixed
Updated outdated complianz.io "more info" links to their current URLs.
Corrected the help link for dynamic translations.
Security
Fixed a CSV/Formula Injection vulnerability in the Data Requests CSV export.
Fixed a Stored Cross-Site Scripting vulnerability in the Elementor cookie blocker's Twitter/Facebook detection.
Replaced a predictable, non-rotating filename token in the Data Requests CSV export with a cryptographically secure one that regenerates on every export.
Changes
September 8th, 2026
7.6.4
1 new3 improvements2 fixes1 change
New
New developer filters `cmplz_pdf_footer_text` and `cmplz_pdf_file_title` to customize the generated document PDF footer and filename, plus an explicit generation-date footer on generated PDF documents.
Improved
Tested and declared compatible with WordPress 7.1.
Prevented redundant Website Scan OAuth token requests on authentication errors.
Updated mPDF to v.8.3.1.
Fixed
Translation downloads now use a buffered download with a fallback directory, resolving intermittent download failures.
Corrected a rendering issue in the settings interface (data breach report and privacy statement fields) caused by an invalid dangerouslySetInnerHTML usage.
Changes
August 24th, 2026
7.6.3
1 new2 improvements6 fixes1 change
New
Optional opt-in consent for the US region. Sites targeting California can switch the entire US region to opt-in from the wizard, blocking statistics and marketing scripts until consent is given. US legal documents update automatically to match.
Improved
Added a global setting to show or hide the Website Scan column in the Posts and Pages overview.
Complianz metaboxes are now compatible with the Remote Table of Contents block editor experience.
Fixed
Cookie banner stylesheet was served over http, causing a mixed-content block on https sites (regression since 7.6.1).
X (Twitter) widget loaded from platform.x.com was not blocked before consent.
Script Center scripts using legacy string enable/async values were not rendered correctly.
Consent statistics were not populated when only Consent Statistics was enabled.
Corrected US English spelling in the US-region legal documents.
Corrected a typo in the Spanish Cookie Policy translation.
Changes
August 10th, 2026
7.6.2
1 fix3 security1 change
Fixed
Fatal error when the Website Scan runs via WP-Cron.
Security
Fixed a PHP Object Injection vulnerability in the cookie banner settings.
The consented-content REST endpoint no longer returns content of password-protected posts.
Hardened the YouTube integration against SSRF — server-side fetches are restricted to YouTube hosts.
Changes
August 3rd, 2026
7.6.1
3 new2 improvements8 fixes2 security1 change
New
Google Tag Gateway support.
Consent debugger for administrators to inspect Consent Mode status, cookies, tag firing sequence and TCF data in real time.
Amazon consent signal integration — marketing consent is now passed to the Amazon ads library on consent and revoke.
Improved
WordPress 7.0 Interactivity API router navigation for the cookie banner is now an opt-in setting under Settings → General. When disabled (default), a compatibility fallback is used on all WordPress versions.
Add [cmplz-tcf-interface] shortcode to render TCF interface standalone.
Fixed
TCF disclosed vendors segment was empty on pages without the cookie policy, causing the IAB CMP Validator to report "Vendors (Disclosed): Failed".
Prevent double-close exception on MaxMind GeoIP DB reader.
Corrected lawful basis options for Brazil region, ensuring the privacy statement renders the selected basis accurately.
Fatal error when activating Complianz Premium in WP 7.0.
Cookie banner stylesheet and consent state were not restored after WordPress Interactivity API client-side navigation (WP 6.9+).
Cookie banner buttons could wrap text unexpectedly on narrow banners.
Improved keyboard focus trap handling in the cookie banner for better accessibility.
The website scan could write scanned page HTML into the statistics settings.
Security
Hardened the Website Scan webhook endpoint with HMAC-signed authentication, closing a gap where forged scan results could be submitted without authentication.
The upgrade installer now requires the install_plugins capability and only downloads packages from the official vendor API.
Changes
July 23th, 2026
7.6.0
3 new6 improvements5 fixes5 changes
New
Scan individual posts and pages on demand via the new Website Scan column in the post overview (premium).
The Website Scan can now run automatically in the background, detecting new cookies on your site over time — opt-in from the Website Scan settings (premium).
Choose which post types the Website Scan covers (premium).
Improved
Added wpml-config.xml to improve WPML compatibility for plugin strings.
Improved Records of Consent with additional data fields and per-record proof-of-consent PDF download.
Daily cleanup of expired transients and obsolete placeholder images.
Notices when webshop pages, custom post types or a high post volume require the advanced Website Scan (free).
Website Scan errors are now visible in the plugin log.
Daily background website scan and cookie change check run via WP-Cron without requiring an admin session.
Fixed
Updated "Dismiss on Timeout" tooltip and GEO IP setup error message.
Support web components in cookie blocker placeholder regex.
Remove unnecessary jQuery dependency from DNSMPD script.
Consent area block content not served when block is nested
Scan progress could keep polling indefinitely when the scan found no cookies.
Changes
June 15th, 2026
Accessibility: Improved screen reader support for cookie banner and manage consent button.
Accessibility: Fixed cookie banner reflow at high zoom levels (400%+).
Accessibility: Fixed interactive consent category controls in cookie banner and cookie policy.
