# iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.6 - Unauthenticated Denial of Service via Comment Content

- **ID:** WPSEC-2026-2211
- **Plugin:** iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more (`iubenda-cookie-law-solution`), https://wordpress.org/plugins/iubenda-cookie-law-solution/
- **Affected versions:** all versions before 3.13.7
- **Fixed in:** 3.13.7 (Update to 3.13.7 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
- **Weakness:** CWE-835
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/iubenda-cookie-law-solution
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2211/

## Description

The iubenda plugin for WordPress is vulnerable to Denial of Service via comment content in all versions up to, and including, 3.13.6, due to an infinite loop in the Native Blocking HTML parser's restore_noise() routine, which writes the placeholder prefix back into the text whenever it meets an unknown placeholder key. This makes it possible for unauthenticated attackers to post a comment containing a crafted placeholder token that uses up memory or execution time and stops any page showing the published comment from rendering.

## References

- https://wpsec.com/vuln/WPSEC-2026-2211/
- https://plugins.svn.wordpress.org/iubenda-cookie-law-solution/tags/3.13.7/
- https://wordpress.org/plugins/iubenda-cookie-law-solution/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2211/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.