CVE-2026-77233: iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite
The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite in all versions up to, and including, 3.13.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability only manifests when the 'Secondary' parser engine is active (parserengine=default); it does not exist under the default 'new' DOM-based parser engine.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more pluginto a version that resolves this vulnerability.Fixed in 3.13.4 - Configuration
Set the plugin’s parser_engine from 'default' (Secondary) to the 'new' DOM-based parser engine to avoid the stored XSS that manifests only when the Secondary engine is active.
iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin (WordPress) parser_engine = new
Event History
Frequently Asked Questions
Which installations are exposed to this issue?
Installations running version 3.13.4 or earlier are exposed only when the Secondary parser engine is active, identified by parser_engine=default. The default new DOM-based parser engine is not affected.
What access does an attacker need?
An attacker does not need authentication or user interaction to inject the stored script. The injected script executes when someone accesses the affected page.
What can be done if updating is not immediately possible?
Use the new DOM-based parser engine rather than the affected Secondary parser engine. The issue does not manifest under the new parser engine.
How can I determine whether my site is affected?
Check whether the plugin version is 3.13.4 or earlier and whether its parser configuration uses parser_engine=default, which enables the Secondary parser engine. Sites using the new DOM-based parser engine are not affected by this issue.