Stored cross-site scripting in iubenda WordPress plugin
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79.
Summary
The iubenda All-in-one Compliance for GDPR / CCPA Cookie Consent WordPress plugin before 3.13.7 does not properly escape content it re-emits through its bundled HTML parser. An unauthenticated user can inject arbitrary web scripts that execute in the browser of any visitor, including logged in administrators. The public exploit is linked in the references.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more WordPress plugin before 3.13.7 does not properly escape content it re-emits through its bundled HTML parser, allowing unauthenticated users to inject arbitrary web scripts in pages that will execute in the session of any visitor viewing them, including logged in administrators.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more | before 3.13.7 | 3.13.7 | Patch available | CNA |
- iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more VendorUnknown Affected before 3.13.7 Fixed in 3.13.7 Patch available CNA
Remediation
Update the iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin to version 3.13.7.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more (Unknown) Fixed in 3.13.7
Timeline
- 2026-11-06 Threatist record created from CVE-2026-86606
- 2026-11-06 Alias added: GHSA-6c22-8c82-m54j
- 2026-11-06 CVSS score added · CISA ADP
- 2026-11-06 Weakness changed · CISA ADP
- 2026-11-06 CISA SSVC decision points changed
References
Sources
- CVE-2026-86606 · CVE Program
- CVE-2026-86606 · NVD
- FIRST EPSS
- GHSA-6c22-8c82-m54j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences