Description

The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.13.6. This is due to the way iubendaParser::parse_comments() re-processes HTML inside IUB-COOKIE-BLOCK markers through the bundled simple_html_dom parser after WordPress has already KSES-filtered the saved comment: simple_html_dom's remove_noise() stores <code> bodies under a deterministic key ('___noise___ 1000') and restore_noise() later substitutes any matching substring back into attribute values WITHOUT re-escaping, allowing a quote-breaking payload stashed in an allowed <code> element to be injected into an allowed <abbr title="___noise___ 1000"> attribute at render time. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, after an administrator approves the first (otherwise moderated) comment under WordPress's default comment_previously_approved setting.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-11-07T03:17:03.690Z",
  "pubdate": "2026-11-07T03:17:03.690Z",
  "executiveSummary": "The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress, in versions up to and including 3.13.6, contains a Stored Cross-Site Scripting (XSS) vulnerability.\nThis flaw exists within the iubendaParser::parse_comments() method, which performs insecure post-processing of HTML content contained within IUB-COOKIE-BLOCK markers.\nBy bypassing WordPress's native KSES (HTML filtering) sanitization via the bundled simple_html_dom parser, an unauthenticated attacker can inject arbitrary JavaScript.\nThe vulnerability requires the exploitation of the parser's deterministic 'noise' restoration mechanism, where stashed content is re-injected into HTML attributes without proper escaping.\nThe impact is significant, as successful exploitation allows for arbitrary script execution in the context of an administrator or visitor viewing the affected page.\nThe attack is viable under default WordPress configuration (comment_previously_approved), requiring only that an administrator approves an initial comment containing the malicious payload.\nThis vulnerability poses a critical risk to site integrity and user security, potentially leading to session hijacking, administrative action manipulation, or malicious redirects.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of HTML content by the iubendaParser::parse_comments() function. The plugin utilizes a bundled version of the simple_html_dom library to re-parse HTML within IUB-COOKIE-BLOCK markers, even after the content has already undergone WordPress's standard KSES sanitization process.\nThe simple_html_dom library utilizes a method called remove_noise() to extract specific HTML elements, such as <code> tags, and replaces them with a deterministic placeholder key (e.g., '___noise___ 1000'). This process is designed to protect these elements during parsing. However, the subsequent restore_noise() function improperly substitutes these stored strings back into the document.\nCrucially, the restore_noise() function performs this substitution directly into attribute values without implementing necessary output encoding or re-escaping mechanisms. Because the plugin allows the use of <code> elements, an attacker can craft a payload containing a quote-breaking character (e.g., \") stashed inside a <code> tag. When the simple_html_dom parser restores this 'noise' into an allowed attribute—specifically the 'title' attribute of an <abbr> tag—the quote-breaking character escapes the attribute context.\nThe attack flow proceeds as follows: 1) An unauthenticated attacker submits a comment containing the malicious <code> payload wrapped within an IUB-COOKIE-BLOCK marker. 2) WordPress saves the comment, with KSES sanitization failing to neutralize the payload because it is encapsulated in the <code> block. 3) The iubendaParser::parse_comments() function executes upon rendering the comment. 4) The simple_html_dom parser identifies the <code> noise and replaces it with the deterministic key. 5) The restore_noise() function injects the payload back into an attribute, effectively closing the attribute context and enabling the execution of arbitrary JavaScript.\nExploitation is feasible for unauthenticated attackers provided the site allows comments. Under the default 'comment_previously_approved' setting, the malicious script triggers once an administrator approves the comment, subsequently executing whenever a user or administrator loads the page containing the comment. This allows for persistent, cross-site scripting attacks that bypass initial server-side sanitization layers."
}