CVE-2026-77233: iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite

Q: Which installations are exposed to this issue?

Installations running version 3.13.4 or earlier are exposed only when the Secondary parser engine is active, identified by parser_engine=default. The default new DOM-based parser engine is not affected.

Q: What access does an attacker need?

An attacker does not need authentication or user interaction to inject the stored script. The injected script executes when someone accesses the affected page.

Q: What can be done if updating is not immediately possible?

Use the new DOM-based parser engine rather than the affected Secondary parser engine. The issue does not manifest under the new parser engine.

Q: How can I determine whether my site is affected?

Check whether the plugin version is 3.13.4 or earlier and whether its parser configuration uses parser_engine=default, which enables the Secondary parser engine. Sites using the new DOM-based parser engine are not affected by this issue.

Published Sep 5, 2026

Updated

The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite in all versions up to, and including, 3.13.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability only manifests when the 'Secondary' parser engine is active (parserengine=default); it does not exist under the default 'new' DOM-based parser engine.

Affected Software

1 affected component

iubenda All-in-one Compliance for GDPR / CCPA Cookie Consent + more (WordPress plugin)<=3.13.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade wordpress/iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin to a version that resolves this vulnerability.
Fixed in 3.13.4
Configuration
Set the plugin’s parser_engine from 'default' (Secondary) to the 'new' DOM-based parser engine to avoid the stored XSS that manifests only when the Secondary engine is active.
iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin (WordPress) parser_engine = new

Event History

Sep 5, 2026

CVE Published

via MITRE·05:30 AM

Data Sourced

via MITRE·05:30 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are exposed to this issue?

Installations running version 3.13.4 or earlier are exposed only when the Secondary parser engine is active, identified by parser_engine=default. The default new DOM-based parser engine is not affected.

What access does an attacker need?

An attacker does not need authentication or user interaction to inject the stored script. The injected script executes when someone accesses the affected page.

What can be done if updating is not immediately possible?

Use the new DOM-based parser engine rather than the affected Secondary parser engine. The issue does not manifest under the new parser engine.

How can I determine whether my site is affected?

Check whether the plugin version is 3.13.4 or earlier and whether its parser configuration uses parser_engine=default, which enables the Secondary parser engine. Sites using the new DOM-based parser engine are not affected by this issue.

CVE-2026-77233: iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite

Affected Software

Remediation

Event History

Frequently Asked Questions

Which installations are exposed to this issue?

What access does an attacker need?

What can be done if updating is not immediately possible?

How can I determine whether my site is affected?

Company

Resources

Contact

Frequently Asked Questions

Which installations are exposed to this issue?

What access does an attacker need?

What can be done if updating is not immediately possible?

How can I determine whether my site is affected?