Description

The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.13.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit works by embedding KSES-allowed markup such as abbr title attributes and HTML comments in a submitted comment so that the global strtr() substitution strips substrings from an inert tag, mutating it into an executable element such as an img onerror handler that runs in the WordPress origin for any visitor, including logged-in administrators.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-05T06:17:09.950Z",
  "pubdate": "2026-09-05T06:17:09.950Z",
  "executiveSummary": "The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress, in all versions up to and including 3.13.4, is susceptible to a critical Stored Cross-Site Scripting (XSS) vulnerability. This flaw stems from inadequate input sanitization and output escaping within the comment content handling mechanism.\nThe vulnerability allows unauthenticated attackers to inject malicious JavaScript into web pages. When a victim, including high-privileged administrators, views the affected page, the injected payload executes within the context of the WordPress origin.\nThis vulnerability poses a significant risk to the integrity and confidentiality of the WordPress installation. Successful exploitation could lead to unauthorized actions, session hijacking, or the distribution of further malicious content. Given the unauthenticated nature of the attack vector, the risk is severe, requiring immediate attention to prevent unauthorized remote code execution through browser-based exploitation.\nUsers are strongly advised to update to a version beyond 3.13.4 if available, or apply compensating controls to restrict comment input handling until a formal patch is deployed.",
  "technicalDetails": "The vulnerability originates from a failure to properly sanitize and escape user-supplied comment content before it is rendered by the WordPress site. The plugin incorrectly handles input processing by relying on ineffective filtering mechanisms that are susceptible to mutation-based bypasses.\nThe exploitation method leverages the global strtr() substitution function. Attackers can craft malicious payloads using KSES-allowed markup—specifically utilizing the 'abbr' title attribute or HTML comments—to circumvent existing security filters. By carefully structuring the input, the attacker forces the server-side substitution process to strip specific substrings from an ostensibly inert HTML tag.\nThis mutation process transforms the benign-looking tags into executable elements, such as an 'img' tag with a crafted 'onerror' handler. Because this payload is stored directly within the comment data, the malicious script becomes persistent, executing in the browser of any user who accesses the compromised page.\nThe attack flow proceeds as follows: First, the unauthenticated attacker submits a specifically crafted comment containing the mutated HTML payload. Second, the server processes the comment, and due to the flawed sanitization logic, the payload is stored in the database without sufficient neutralization of executable tags. Third, when a victim (e.g., a site administrator or standard user) loads a page displaying these comments, the browser interprets the mutated tags as active HTML elements.\nConsequently, the malicious script executes within the security context of the WordPress origin. The payload operates with the permissions of the victim's session, allowing for the execution of arbitrary JavaScript. This can facilitate full account takeover through session token theft, unauthorized administrative modifications, or the redirection of visitors to malicious external sites. The impact is elevated by the fact that no prior authentication is required to submit the comment, and the payload is triggered automatically upon rendering, requiring zero interaction from the target victim other than viewing the affected page. The vulnerable component is the comment processing module of the iubenda plugin, and the flaw is present in all versions up to 3.13.4."
}