{
 "id": "WPSEC-2026-2211",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2211/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2211/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2211/index.md",
 "title": "iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.6 - Unauthenticated Denial of Service via Comment Content",
 "description": "The iubenda plugin for WordPress is vulnerable to Denial of Service via comment content in all versions up to, and including, 3.13.6, due to an infinite loop in the Native Blocking HTML parser's restore_noise() routine, which writes the placeholder prefix back into the text whenever it meets an unknown placeholder key. This makes it possible for unauthenticated attackers to post a comment containing a crafted placeholder token that uses up memory or execution time and stops any page showing the published comment from rendering.",
 "plugin": {
  "slug": "iubenda-cookie-law-solution",
  "name": "iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more",
  "full_name": "iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more",
  "wordpress_org": "https://wordpress.org/plugins/iubenda-cookie-law-solution/",
  "advisories_url": "https://wpsec.com/vuln/plugin/iubenda-cookie-law-solution/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/iubenda-cookie-law-solution"
 },
 "type": "DOS",
 "cwe": [
  "CWE-835"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.13.7",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.13.7"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.13.7",
 "remediation": "Update to 3.13.7 or later.",
 "fix_released": "2026-11-02T12:10:36+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:19:59.784253+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2211/",
  "https://plugins.svn.wordpress.org/iubenda-cookie-law-solution/tags/3.13.7/",
  "https://wordpress.org/plugins/iubenda-cookie-law-solution/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/iubenda-cookie-law-solution",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-03"
 }
}