Vulnerabilities / iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more / WPSEC-2026-2211
iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.6 - Unauthenticated Denial of Service via Comment Content
Medium 5.3
CWE-835Fixed in 3.13.7
- ID
- WPSEC-2026-2211
- Plugin
- iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more (iubenda-cookie-law-solution)
- Affected
- all versions before 3.13.7
- Remediation
- Update to 3.13.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Weakness
- CWE-835
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-03
- Attack surface
- iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more on WPSec AttackSurface
- Fix released
- Published
Description
The iubenda plugin for WordPress is vulnerable to Denial of Service via comment content in all versions up to, and including, 3.13.6, due to an infinite loop in the Native Blocking HTML parser's restore_noise() routine, which writes the placeholder prefix back into the text whenever it meets an unknown placeholder key. This makes it possible for unauthenticated attackers to post a comment containing a crafted placeholder token that uses up memory or execution time and stops any page showing the published comment from rendering.
References
- https://wpsec.com/vuln/WPSEC-2026-2211/
- https://plugins.svn.wordpress.org/iubenda-cookie-law-solution/tags/3.13.7/
- https://wordpress.org/plugins/iubenda-cookie-law-solution/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS