Read the docs
TI-2026-86182 Aliases CVE-2026-120540GHSA-qp3p-7592-f8mv

Stored cross-site scripting in iubenda WordPress plugin via comments

Priority LOW 31CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress, all versions up to and including 3.13.6, is vulnerable to stored cross-site scripting (CWE-79). Comment HTML is re-processed and restored into an attribute without re-escaping, so injected markup runs in the page. An unauthenticated attacker can inject scripts that run when a user opens an affected page, once an administrator approves the first comment under default WordPress settings.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.13.6. This is due to the way iubendaParser::parse_comments() re-processes HTML inside IUB-COOKIE-BLOCK markers through the bundled simple_html_dom parser after WordPress has already KSES-filtered the saved comment: simple_html_dom's remove_noise() stores <code> bodies under a deterministic key ('___noise___ 1000') and restore_noise() later substitutes any matching substring back into attribute values WITHOUT re-escaping, allowing a quote-breaking payload stashed in an allowed <code> element to be injected into an allowed <abbr title="___noise___ 1000"> attribute at render time. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, after an administrator approves the first (otherwise moderated) comment under WordPress's default comment_previously_approved setting.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00247 16th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
iubendaiubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + moreup to 3.13.6—No fix listedCNA
  • iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more Vendoriubenda Affected up to 3.13.6 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Timeline

  1. 2026-11-07 Threatist record created from CVE-2026-120540
  2. 2026-11-07 Alias added: GHSA-qp3p-7592-f8mv
  3. 2026-11-07 CISA SSVC decision points changed
  4. 2026-11-07 Priority changed: MEDIUM → LOW

References

Other 8

  • TI-2022-03587 iubenda < 3.3.3 - Subscriber+ Privileges Escalation to Admin CVSS 3.1HIGH 8.8
  • TI-2026-53920 Cross-site scripting in iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent +… CVSS 3.1HIGH 7.2
  • TI-2026-53947 Cross-site scripting in iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent +… CVSS 3.1HIGH 7.2
  • TI-2020-10128 The iubenda-cookie-law-solution plugin before 2.3.5 for WordPress does not restrict URL sanitization to http protocols. CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences