Complianz Privacy Suite (GDPR/CCPA) Premium

Version 7.6.7 — 19 October 2026

• Security Fixed a Stored Cross-Site Scripting vulnerability in the YotuWP cookie blocker.
• Improved TCF updated to IAB Policies v5.0.b: Features, Special features and Special purposes are shown as the policy requires, the TC String reports the service-specific scope, and legitimate interest is no longer set for vendors that only declare special purposes.
• Fixed TCF consent banner no longer breaks when the vendor list files fail to load, and language files stuck on an outdated vendor list are now refreshed.
• Fixed TCF returning visitors' saved vendor choices are no longer replaced by "accept all" when the page loads, and the vendor checkboxes on the Cookie Policy page match the consent after accepting.
• Fixed TCF vendor choices were not saved on the vendor list page when an Additional Consent provider id was above 65535.
• Fixed TCF vendors kept their consent in the TC String after the cookie policy changed and the banner revoked consent.
• Fixed On sites with A/B testing or more than one consent type, the cookie banner briefly appeared unstyled with an oversized close icon, because its stylesheet was only fetched after the banner script ran.
• Fixed The cookie banner stylesheet URL in the page source kept its unresolved {banner_id} and {type} placeholders, which search engines reported as a 404. On sites without A/B testing and with a single consent type, the URL is now resolved server-side. Code filtering css_file through cmplz_cookiebanner_settings should no longer assume it contains placeholders.
• Fixed With Google Site Kit inserting the Tag Manager container, Complianz added a second, empty Tag Manager container to the page. With Consent Mode enabled the signals are now printed in the header, before Site Kit's container, instead of in the footer.
• Fixed On sites upgraded from before 7.0, a placeholder switched off on the old Integrations page could not be switched back on for services with a dash in their name, such as Google Maps: Integrations > Services reported the placeholder as enabled while the content was blocked with no placeholder at all, and the toggle had no effect. The setting is now reported accurately and can be changed again from Integrations > Services.
• Fixed Switching a placeholder on or off now takes effect on the front end immediately, instead of after up to 30 minutes.
• Fixed The cookie banner no longer fails to show after a cookie policy change on sites with a page cache, which left visitors without a banner and with all consent denied.
• Fixed On locked premium settings, the upgrade link text no longer showed raw placeholder tokens.
• Fixed On some setups, the cookie banner and script blocking could be silently absent because the cookie-warning check ran before other plugins' filters were registered.
• Fixed The "accept service" button label showed a raw {Service} placeholder in some German translations.
• Fixed The accessible name of the placeholder buttons now includes their visible text (WCAG 2.5.3).
• Fixed The data request endpoint reported requests as successful and sent confirmation mail even when the request failed to save, including on installs where its database table didn't exist yet; it also stayed active on sites not using the feature.
• Fixed Google Analytics 4 sent the first page view of a returning visitor as unconsented. Consent Mode now waits up to 500 ms for the saved consent, adjustable with the cmplz_gtag_wait_for_update filter.

Earlier versions

• 7.6.5 (8 September 2026): 3 fixed, 3 security
• 7.6.4 (24 August 2026): 1 new, 3 improved, 2 fixed
• 7.6.3 (10 August 2026): 1 new, 2 improved, 6 fixed