# iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.5 - Unauthenticated Stored Cross-Site Scripting via Native Blocking HTML Parser

- **ID:** WPSEC-2026-1822
- **Plugin:** iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more (`iubenda-cookie-law-solution`), https://wordpress.org/plugins/iubenda-cookie-law-solution/
- **Affected versions:** all versions before 3.13.6
- **Fixed in:** 3.13.6 (Update to 3.13.6 or later.)
- **Severity:** High 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-28)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/iubenda-cookie-law-solution
- **Fix released:** 2026-10-27
- **Published:** 2026-10-28
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1822/

## Description

The iubenda plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Native Blocking HTML parser in all versions up to, and including, 3.13.5. This is due to insufficient escaping when comment and code content is restored into the re-parsed page HTML and when attribute values are re-serialized. A quote character inside the restored text can close an attribute early and inject new attributes such as event handlers. This makes it possible for unauthenticated attackers to inject arbitrary web scripts through comment content, which execute whenever a user accesses a page displaying the comment while Native Blocking is enabled (the default), with either parsing engine.

## References

- https://wpsec.com/vuln/WPSEC-2026-1822/
- https://plugins.svn.wordpress.org/iubenda-cookie-law-solution/tags/3.13.6/
- https://wordpress.org/plugins/iubenda-cookie-law-solution/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1822/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.