CVE-2026-77263: iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content

Q: Who can exploit this issue, and what access do they need?

An unauthenticated attacker can exploit it by submitting a crafted comment. No account, administrative privileges, or user interaction is required for the injection itself.

Q: Which sites are exposed?

WordPress sites using the affected plugin in versions through 3.13.4 are exposed where an attacker can submit a comment that is processed by the vulnerable code. The provided information does not identify any configuration setting that disables the issue.

Q: What is the impact when the payload executes?

The injected script executes in the WordPress origin when someone visits the affected page. This can affect any visitor, including logged-in administrators, and may expose or alter information accessible through that user's browser session.

Q: How can administrators check for attempted or successful exploitation?

Review submitted and published comments for unusual HTML, particularly abbr elements with title attributes and embedded HTML comments. Investigate comments whose markup could be transformed after processing into executable elements or event-handler attributes such as img onerror.

Q: What can be done if updating is not immediately possible?

Restrict or disable public comment submission where feasible, and moderate or remove untrusted comments containing HTML markup. Existing comments should be reviewed because this is a stored XSS issue that can execute when affected pages are visited.

Published Sep 5, 2026

Updated

The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.13.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit works by embedding KSES-allowed markup such as abbr title attributes and HTML comments in a submitted comment so that the global strtr() substitution strips substrings from an inert tag, mutating it into an executable element such as an img onerror handler that runs in the WordPress origin for any visitor, including logged-in administrators.

Affected Software

1 affected component

WordPress plugin/iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more<=3.13.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress to a version that resolves this vulnerability.
Fixed in 3.13.4

Event History

Sep 5, 2026

CVE Published

via MITRE·05:30 AM

Data Sourced

via MITRE·05:30 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue, and what access do they need?

An unauthenticated attacker can exploit it by submitting a crafted comment. No account, administrative privileges, or user interaction is required for the injection itself.

Which sites are exposed?

WordPress sites using the affected plugin in versions through 3.13.4 are exposed where an attacker can submit a comment that is processed by the vulnerable code. The provided information does not identify any configuration setting that disables the issue.

What is the impact when the payload executes?

The injected script executes in the WordPress origin when someone visits the affected page. This can affect any visitor, including logged-in administrators, and may expose or alter information accessible through that user's browser session.

How can administrators check for attempted or successful exploitation?

Review submitted and published comments for unusual HTML, particularly abbr elements with title attributes and embedded HTML comments. Investigate comments whose markup could be transformed after processing into executable elements or event-handler attributes such as img onerror.

What can be done if updating is not immediately possible?

Restrict or disable public comment submission where feasible, and moderate or remove untrusted comments containing HTML markup. Existing comments should be reviewed because this is a stored XSS issue that can execute when affected pages are visited.

CVE-2026-77263: iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue, and what access do they need?

Which sites are exposed?

What is the impact when the payload executes?

How can administrators check for attempted or successful exploitation?

What can be done if updating is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue, and what access do they need?

Which sites are exposed?

What is the impact when the payload executes?

How can administrators check for attempted or successful exploitation?

What can be done if updating is not immediately possible?