CVE-2026-86606: iubenda < 3.13.7 - Unauthenticated Stored XSS via Cookie Block HTML Parser

Q: Who can exploit this issue, and who is affected by the injected script?

No authentication is required to inject the stored script. It executes for visitors who view the affected page, including logged-in WordPress administrators.

Q: What component or behavior is involved in exploitation?

The issue involves content that the plugin re-emits through its bundled HTML parser. The parser does not properly escape that content, allowing arbitrary web scripts to be stored and later executed.

Published Nov 6, 2026

Updated

The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more WordPress plugin before 3.13.7 does not properly escape content it re-emits through its bundled HTML parser, allowing unauthenticated users to inject arbitrary web scripts in pages that will execute in the session of any visitor viewing them, including logged in administrators.

Event History

Nov 6, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue, and who is affected by the injected script?

No authentication is required to inject the stored script. It executes for visitors who view the affected page, including logged-in WordPress administrators.

What component or behavior is involved in exploitation?

The issue involves content that the plugin re-emits through its bundled HTML parser. The parser does not properly escape that content, allowing arbitrary web scripts to be stored and later executed.

CVE-2026-86606: iubenda < 3.13.7 - Unauthenticated Stored XSS via Cookie Block HTML Parser

Event History

Frequently Asked Questions

Who can exploit this issue, and who is affected by the injected script?

What component or behavior is involved in exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue, and who is affected by the injected script?

What component or behavior is involved in exploitation?