iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.5 - Unauthenticated Stored Cross-Site Scripting via Native Blocking HTML Parser
- ID
- WPSEC-2026-1822
- Plugin
- iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more (iubenda-cookie-law-solution)
- Affected
- all versions before 3.13.6
- Remediation
- Update to 3.13.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-28
- Attack surface
- iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more on WPSec AttackSurface
- Fix released
- Published
Description
The iubenda plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Native Blocking HTML parser in all versions up to, and including, 3.13.5. This is due to insufficient escaping when comment and code content is restored into the re-parsed page HTML and when attribute values are re-serialized. A quote character inside the restored text can close an attribute early and inject new attributes such as event handlers. This makes it possible for unauthenticated attackers to inject arbitrary web scripts through comment content, which execute whenever a user accesses a page displaying the comment while Native Blocking is enabled (the default), with either parsing engine.
References
- https://wpsec.com/vuln/WPSEC-2026-1822/
- https://plugins.svn.wordpress.org/iubenda-cookie-law-solution/tags/3.13.6/
- https://wordpress.org/plugins/iubenda-cookie-law-solution/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS