Description

The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more WordPress plugin before 3.13.7 does not properly escape content it re-emits through its bundled HTML parser, allowing unauthenticated users to inject arbitrary web scripts in pages that will execute in the session of any visitor viewing them, including logged in administrators.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-11-06T06:16:44.237Z",
  "pubdate": "2026-11-06T06:16:44.237Z",
  "executiveSummary": "The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more WordPress plugin, in versions prior to 3.13.7, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability.\nThis vulnerability stems from improper output sanitization within the plugin's bundled HTML parser, allowing unauthenticated threat actors to inject malicious JavaScript payloads into web pages rendered by the application.\nThe attack vector resides in the plugin's data handling mechanisms, where user-supplied input is echoed back to the browser without adequate context-aware escaping. When an unsuspecting visitor—including administrative users—loads a compromised page, the malicious script executes within the context of their active session.\nThe implications are severe, as successful exploitation enables session hijacking, unauthorized administrative actions, sensitive information theft, and potential full account takeover. Because the vulnerability does not require prior authentication, it poses a significant risk to the integrity and security of the WordPress installation and its user base.",
  "technicalDetails": "The root cause of this vulnerability is a failure in the output processing layer of the iubenda plugin's bundled HTML parser. Specifically, the component responsible for rendering and re-emitting stored content fails to implement necessary output encoding or sanitization routines for untrusted data injected into the document object model (DOM).\nUnder normal operating conditions, the plugin processes various configuration settings and compliance data. If the input mechanisms lack stringent validation, an attacker can submit crafted input containing script tags or event handlers (e.g., <script>alert(document.cookie)</script> or <img src=x onerror=alert(1)>). Because this content is improperly handled by the parser, it is stored in the database and subsequently rendered as executable HTML code.\nThe attack flow proceeds as follows: First, an unauthenticated attacker identifies an injection point within the plugin's configuration or settings interface where input is improperly reflected. Second, the attacker submits a malicious payload. Third, the application stores this payload persistently. Fourth, whenever a legitimate user or administrator navigates to the affected page, the server delivers the compromised content. Finally, the victim's browser parses the malicious script as legitimate code, resulting in execution in the user's session.\nThe vulnerable component is the internal HTML parsing logic provided by the plugin. Versions prior to 3.13.7 are confirmed to be affected. The attack is executable via standard network exposure as the plugin interface or the affected pages are typically publicly accessible. Because the script executes in the victim's browser, the attacker can leverage the victim's existing session privileges to perform unauthorized actions, such as changing plugin settings, creating new administrator accounts, or exfiltrating non-public data through background HTTP requests (Fetch or XHR).\nPost-exploitation impact includes persistent compromise of the WordPress environment. Since administrative users are also susceptible, an attacker can achieve privilege escalation by tricking an administrator into triggering the payload, thereby granting the attacker control over the WordPress dashboard or allowing the injection of malicious code into theme files or other site components."
}