12 versions
Complianz Premium – GDPR/CCPA Cookie Consent history.
Every release of Complianz Premium – GDPR/CCPA Cookie Consent is archived here with its changelog, file size, and security scan result. Use the archive to roll back to a stable release or audit what changed between updates.
10 of 12 releases scanned clean
v7.6.7Latest
October 19, 20267.9 MBScanned
Other
- October 19th, 2026
- Security: Fixed a Stored Cross-Site Scripting vulnerability in the YotuWP cookie blocker.
Added
- TCF updated to IAB Policies v5.0.b: Features, Special features and Special purposes are shown as the policy requires, the TC String reports the service-specific scope, and legitimate interest is no longer set for vendors that only declare special purposes.
Fixed
- TCF consent banner no longer breaks when the vendor list files fail to load, and language files stuck on an outdated vendor list are now refreshed.
- TCF returning visitors' saved vendor choices are no longer replaced by "accept all" when the page loads, and the vendor checkboxes on the Cookie Policy page match the consent after accepting.
- TCF vendor choices were not saved on the vendor list page when an Additional Consent provider id was above 65535.
- TCF vendors kept their consent in the TC String after the cookie policy changed and the banner revoked consent.
- On sites with A/B testing or more than one consent type, the cookie banner briefly appeared unstyled with an oversized close icon, because its stylesheet was only fetched after the banner script ran.
- The cookie banner stylesheet URL in the page source kept its unresolved {banner_id} and {type} placeholders, which search engines reported as a 404. On sites without A/B testing and with a single consent type, the URL is now resolved server-side. Code filtering css_file through cmplz_cookiebanner_settings should no longer assume it contains placeholders.
- With Google Site Kit inserting the Tag Manager container, Complianz added a second, empty Tag Manager container to the page. With Consent Mode enabled the signals are now printed in the header, before Site Kit's container, instead of in the footer.
- On sites upgraded from before 7.0, a placeholder switched off on the old Integrations page could not be switched back on for services with a dash in their name, such as Google Maps: Integrations > Services reported the placeholder as enabled while the content was blocked with no placeholder at all, and the toggle had no effect. The setting is now reported accurately and can be changed again from Integrations > Services.
- Switching a placeholder on or off now takes effect on the front end immediately, instead of after up to 30 minutes.
- The cookie banner no longer fails to show after a cookie policy change on sites with a page cache, which left visitors without a banner and with all consent denied.
- On locked premium settings, the upgrade link text no longer showed raw placeholder tokens.
- On some setups, the cookie banner and script blocking could be silently absent because the cookie-warning check ran before other plugins' filters were registered.
- The "accept service" button label showed a raw {Service} placeholder in some German translations.
- The accessible name of the placeholder buttons now includes their visible text (WCAG 2.5.3).
- The data request endpoint reported requests as successful and sent confirmation mail even when the request failed to save, including on installs where its database table didn't exist yet; it also stayed active on sites not using the feature.
- Google Analytics 4 sent the first page view of a returning visitor as unconsented. Consent Mode now waits up to 500 ms for the saved consent, adjustable with the cmplz_gtag_wait_for_update filter.
September 22, 20268.0 MBScanned
Other
- September 8th, 2026
- Security: Fixed a CSV/Formula Injection vulnerability in the Data Requests CSV export.
- Security: Fixed a Stored Cross-Site Scripting vulnerability in the Elementor cookie blocker's Twitter/Facebook detection.
- Security: Replaced a predictable, non-rotating filename token in the Data Requests CSV export with a cryptographically secure one that regenerates on every export.
Fixed
- With TCF enabled, auto-updates were reported as disabled for all plugins in Site Health.
- Updated outdated complianz.io "more info" links to their current URLs.
- Corrected the help link for dynamic translations.
August 25, 20268.0 MBScanned
Other
- August 24th, 2026
Added
- Tested and declared compatible with WordPress 7.1.
- Prevented redundant Website Scan OAuth token requests on authentication errors.
- New developer filters `cmplz_pdf_footer_text` and `cmplz_pdf_file_title` to customize the generated document PDF footer and filename, plus an explicit generation-date footer on generated PDF documents.
Fixed
- Translation downloads now use a buffered download with a fallback directory, resolving intermittent download failures.
- Corrected a rendering issue in the settings interface (data breach report and privacy statement fields) caused by an invalid dangerouslySetInnerHTML usage.
v7.6.3Unavailable
August 18, 20268.0 MBScanned
Other
- August 10th, 2026
Added
- Optional opt-in consent for the US region. Sites targeting California can switch the entire US region to opt-in from the wizard, blocking statistics and marketing scripts until consent is given. US legal documents update automatically to match.
- Added a global setting to show or hide the Website Scan column in the Posts and Pages overview.
- Complianz metaboxes are now compatible with the Remote Table of Contents block editor experience.
Fixed
- Cookie banner stylesheet was served over http, causing a mixed-content block on https sites (regression since 7.6.1).
- X (Twitter) widget loaded from platform.x.com was not blocked before consent.
- Script Center scripts using legacy string enable/async values were not rendered correctly.
- Consent statistics were not populated when only Consent Statistics was enabled.
- Corrected US English spelling in the US-region legal documents.
- Corrected a typo in the Spanish Cookie Policy translation.
v7.6.1Unavailable
July 24, 20268.0 MBScanned
Other
- July 23th, 2026
- Security: The upgrade installer now requires the install_plugins capability and only downloads packages from the official vendor API.
Added
- Google Tag Gateway support.
- Consent debugger for administrators to inspect Consent Mode status, cookies, tag firing sequence and TCF data in real time.
- Amazon consent signal integration — marketing consent is now passed to the Amazon ads library on consent and revoke.
- WordPress 7.0 Interactivity API router navigation for the cookie banner is now an opt-in setting under Settings → General. When disabled (default), a compatibility fallback is used on all WordPress versions.
- Add [cmplz-tcf-interface] shortcode to render TCF interface standalone.
Fixed
- TCF disclosed vendors segment was empty on pages without the cookie policy, causing the IAB CMP Validator to report "Vendors (Disclosed): Failed".
- Prevent double-close exception on MaxMind GeoIP DB reader.
- Corrected lawful basis options for Brazil region, ensuring the privacy statement renders the selected basis accurately.
- Fatal error when activating Complianz Premium in WP 7.0.
- Cookie banner stylesheet and consent state were not restored after WordPress Interactivity API client-side navigation (WP 6.9+).
- Cookie banner buttons could wrap text unexpectedly on narrow banners.
- Improved keyboard focus trap handling in the cookie banner for better accessibility.
- The website scan could write scanned page HTML into the statistics settings.
v7.6.0Unavailable
June 25, 20267.9 MBScanned
Other
- June 15th, 2026
- Accessibility: Improved screen reader support for cookie banner and manage consent button.
- Accessibility: Fixed cookie banner reflow at high zoom levels (400%+).
- Accessibility: Fixed interactive consent category controls in cookie banner and cookie policy.
- Accessibility: Fixed TCF vendor links missing discernible text.
Added
- Scan individual posts and pages on demand via the new Website Scan column in the post overview (premium).
- The Website Scan can now run automatically in the background, detecting new cookies on your site over time — opt-in from the Website Scan settings (premium).
- Choose which post types the Website Scan covers (premium).
- Added wpml-config.xml to improve WPML compatibility for plugin strings.
- Improved Records of Consent with additional data fields and per-record proof-of-consent PDF download.
- Daily cleanup of expired transients and obsolete placeholder images.
- Notices when webshop pages, custom post types or a high post volume require the advanced Website Scan (free).
- Website Scan errors are now visible in the plugin log.
- Daily background website scan and cookie change check run via WP-Cron without requiring an admin session.
Fixed
- Updated "Dismiss on Timeout" tooltip and GEO IP setup error message.
- Support web components in cookie blocker placeholder regex.
- Remove unnecessary jQuery dependency from DNSMPD script.
- Consent area block content not served when block is nested
- Scan progress could keep polling indefinitely when the scan found no cookies.
June 8, 20267.9 MBScanned
Other
- May 18th, 2026
- Security: Fixed DOM-based Cross-Site Scripting (XSS) vulnerability.
- Security: Updated 're' dependency to remediate known vulnerability.
- Security: Cookie scanner and Cookiedatabase sync now require WSC authentication. Unauthenticated installs see a locked state with onboarding prompt.
- Accessibility: Fixed heading hierarchy in cookie policy page.
Added
- Improved WSC onboarding modal — simplified dismiss logic, single-option state with automatic migration from legacy options.
- Added integration notice for FunnelKit.
- Updated default cookie banner color scheme to improve accessibility contrast.
Fixed
- Mixed languages on cookie policy page when syncing non-English cookies from Cookiedatabase.
- Consent statistics now collected for all categories in non-EU regions.
- TCF vendor list download conditions; added warning when file permissions prevent download.
- TCF language file handling.
- WSC credentials not cleared from database after reset.
- PHP 8.1 deprecation notices in cookie blocker and WSC authentication handler.
v7.5.7.2Unavailable
April 7, 20267.9 MBScanned
Other
- April 7th, 2026
- Security: Fixed unauthorized access to post content via REST API endpoint.
Fixed
- Prevent PHP warnings when cookiedatabase.org returns a malformed or unexpected response during sync.
- Resolved infinite page reload loop triggered by auto-dismiss on scroll or timeout.
Added
- Updated Gutenberg blocks to API version 3.
v7.5.7.1Unavailable
March 13, 20268.3 MBScanned
Other
- March 10th, 2026
Fixed
- Cookie banner focus trap incorrectly re-activating after consent was given, blocking page links during navigation.
Why archive
Sometimes the latest release isn't the one you need. The archive lets you pin Complianz Premium – GDPR/CCPA Cookie Consent to a known-good version, or roll back while a bug is investigated. Every release stays scanned and reachable.