Description

The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite in all versions up to, and including, 3.13.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability only manifests when the 'Secondary' parser engine is active (parser_engine=default); it does not exist under the default 'new' DOM-based parser engine.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-05T06:17:09.780Z",
  "pubdate": "2026-09-05T06:17:09.780Z",
  "executiveSummary": "The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability.\nThis security flaw stems from inadequate input sanitization and output escaping within the plugin's AdSense Regex Rewrite functionality.\nThe vulnerability allows unauthenticated remote attackers to inject malicious JavaScript into comment sections, which subsequently executes within the browser context of any user visiting the affected page.\nThe impact is significant, as it enables unauthorized script execution, potential session hijacking, administrative action spoofing, and unauthorized redirection of users.\nThis vulnerability is restricted to environments where the 'Secondary' parser engine (parser_engine=default) is configured, rather than the contemporary 'new' DOM-based parser engine.\nGiven the nature of the vulnerability, it poses a high risk to WordPress installations utilizing the affected plugin configuration, as it bypasses the need for administrative privileges to execute arbitrary client-side code.",
  "technicalDetails": "The root cause of this vulnerability is improper handling of user-supplied data within the AdSense Regex Rewrite feature of the iubenda plugin. When the 'Secondary' (legacy) parser engine is active, the plugin fails to sanitize user-submitted comment content or escape it appropriately before rendering it in the DOM.\nStored XSS occurs when an application stores untrusted data—in this instance, within comment fields—and subsequently embeds that data into a webpage without sufficient validation. Because the plugin processes these comments through an regex-based rewrite engine, malicious payloads embedded within standard comment strings are processed and rendered as executable code.\nThe exploitation flow begins with an unauthenticated attacker crafting a comment containing a malicious JavaScript payload, such as <script>alert(document.cookie)</script>. This payload is submitted to the WordPress comment form. The server-side application accepts the comment and stores it in the WordPress database.\nWhen a user or administrator navigates to the post containing the malicious comment, the iubenda plugin's 'Secondary' parser engine retrieves the raw comment data. Due to the lack of output escaping, the plugin injects the attacker's script directly into the page's HTML structure. The victim's browser, upon parsing the injected HTML, executes the malicious script under the context of the site's origin.\nThe vulnerability is specific to the 'Secondary' parser engine (parser_engine=default). This engine lacks the security controls present in the 'new' DOM-based parser engine, which is likely designed to handle content with more secure DOM node creation rather than relying on regex-based string manipulation.\nThe post-exploitation impact includes the ability for an attacker to capture sensitive cookies (if HttpOnly is not set correctly), perform actions on behalf of the user, or modify the visual content of the page to conduct phishing attacks. Because the injection is stored, the attack is persistent and affects every user who views the page until the malicious comment is removed by an administrator."
}