{"id":"CVE-2026-120540","kind":"vulnerability","aliases":["CVE-2026-120540"],"related":[],"title":"iubenda WordPress plugin: stored XSS via comments, up to 3.13.6","description":"The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.13.6. This is due to the way iubendaParser::parse_comments() re-processes HTML inside IUB-COOKIE-BLOCK markers through the bundled simple_html_dom parser after WordPress has already KSES-filtered the saved comment: simple_html_dom's remove_noise() stores <code> bodies under a deterministic key ('___noise___ 1000') and restore_noise() later substitutes any matching substring back into attribute values WITHOUT re-escaping, allowing a quote-breaking payload stashed in an allowed <code> element to be injected into an allowed <abbr title=\"___noise___ 1000\"> attribute at render time. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, after an administrator approves the first (otherwise moderated) comment under WordPress's default comment_previously_approved setting.","summary":"The iubenda cookie consent WordPress plugin up to and including 3.13.6 re-parses HTML in comments, letting a crafted payload escape an attribute and inject script. An unauthenticated attacker can get script to run in visitors' browsers once an administrator approves the first comment.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["iubenda","runtime","self-hosted","wordpress"],"not_affected_if":["comments-disabled","newer-version","plugin-not-installed"],"how_to_check":"- Check the installed iubenda plugin version in the WordPress admin plugin list or `wp plugin get iubenda --field=version`\n- Confirm whether the site accepts comments and whether comments are moderated before first approval","fix":"- iubenda plugin: move to a version later than `3.13.6` (the sources do not name the fixed release)","status":"open","published_at":"2026-11-07T03:17:03+00:00","first_seen_at":"2026-11-07T03:45:35+00:00","triaged_at":"2026-11-07T03:47:45+00:00","updated_at":"2026-11-07T03:47:45+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-07T03:47:45Z","model":"claude-haiku-5-5","output":{"fix":"- iubenda plugin: move to a version later than `3.13.6` (the sources do not name the fixed release)","reach":"internet","title":"iubenda WordPress plugin: stored XSS via comments, up to 3.13.6","impact":"medium","summary":"The iubenda cookie consent WordPress plugin up to and including 3.13.6 re-parses HTML in comments, letting a crafted payload escape an attribute and inject script. An unauthenticated attacker can get script to run in visitors' browsers once an administrator approves the first comment.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wordpress","iubenda","self-hosted"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker script runs in visitors' browsers on the affected site.","analyst_note":"Confirm the fixed version of the iubenda plugin after 3.13.6 from the WordPress plugin changelog or NVD.","how_to_check":"- Check the installed iubenda plugin version in the WordPress admin plugin list or `wp plugin get iubenda --field=version`\n- Confirm whether the site accepts comments and whether comments are moderated before first approval","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","comments-disabled","newer-version"],"who_is_affected":"Sites running the iubenda plugin at version 3.13.6 or earlier that accept public comments and display pages containing the IUB-COOKIE-BLOCK markers. Sites without the plugin, or running a later version, are not affected; sites that do not accept comments are unlikely to be reached.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000756,"input_tokens":4511,"output_tokens":609,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120540':13A,16A '-2026':12A,15A '1000':148C '3.13.6':10A,33B,98C 'access':206C 'administr':63B,212C 'all-in-on':70C 'allow':165C,174C,181C 'alreadi':128C 'approv':64B,213C,225C 'arbitrari':195C 'attack':52B,192C 'attribut':46B,159C,182C 'back':157C 'block':116C 'bodi':142C 'break':169C 'browser':60B 'bundl':120C 'ccpa':77C 'comment':7A,39B,67B,107C,134C,218C,223C 'complianc':74C 'consent':26B,79C 'cooki':25B,78C,115C 'craft':42B 'cross':89C 'cross-sit':88C 'cve':11A,14A 'default':222C 'determinist':145C 'dom':123C,137C 'due':101C 'element':175C 'escap':44B,164C 'execut':202C 'filter':131C 'first':66B,215C 'gdpr':76C 'get':54B 'host':21B 'html':37B,111C,122C,136C 'includ':32B,97C 'inject':48B,178C,194C,208C 'insid':112C 'iub':114C 'iub-cookie-block':113C 'iubenda':1A,17B,24B,69C 'iubendapars':105C 'key':146C 'kses':130C 'kses-filt':129C 'later':152C 'let':40B 'make':187C 'marker':117C 'match':155C 'moder':217C 'nois':140C,147C,151C 'one':73C 'otherwis':216C 'page':199C,209C 'pars':36B,106C 'parser':124C 'payload':43B,170C 'plugin':3A,28B,81C 'possibl':189C 'previous':224C 'process':110C 'quot':168C 'quote-break':167C 're':35B,109C,163C 're-escap':162C 're-pars':34B 're-process':108C 'remov':139C 'render':184C 'restor':150C 'run':57B 'runtim':18B 'save':133C 'script':49B,55B,91C,197C 'self':20B 'self-host':19B 'set':226C 'simpl':121C,135C 'site':90C 'stash':171C 'store':4A,87C,141C 'substitut':153C 'substr':156C 'time':185C 'unauthent':51B,191C 'user':205C 'valu':160C 'version':93C 'via':6A 'visitor':59B 'vulner':85C 'way':104C 'web':196C 'whenev':203C 'without':161C 'wordpress':2A,22B,27B,83C,126C,220C 'xss':5A","nicknames":[],"mitigations":[],"who_affected":"Sites running the iubenda plugin at version 3.13.6 or earlier that accept public comments and display pages containing the IUB-COOKIE-BLOCK markers. Sites without the plugin, or running a later version, are not affected; sites that do not accept comments are unlikely to be reached.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","iubenda","runtime","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-120540':13A,16A '-2026':12A,15A '3.13.6':10A 'comment':7A 'cve':11A,14A 'iubenda':1A 'plugin':3A 'store':4A 'via':6A 'wordpress':2A 'xss':5A","search_b":"'3.13.6':33B 'administr':63B 'approv':64B 'attack':52B 'attribut':46B 'browser':60B 'comment':39B,67B 'consent':26B 'cooki':25B 'craft':42B 'escap':44B 'first':66B 'get':54B 'host':21B 'html':37B 'includ':32B 'inject':48B 'iubenda':17B,24B 'let':40B 'pars':36B 'payload':43B 'plugin':28B 're':35B 're-pars':34B 'run':57B 'runtim':18B 'script':49B,55B 'self':20B 'self-host':19B 'unauthent':51B 'visitor':59B 'wordpress':22B,27B","search_c":"'1000':148C '3.13.6':98C 'access':206C 'administr':212C 'all-in-on':70C 'allow':165C,174C,181C 'alreadi':128C 'approv':213C,225C 'arbitrari':195C 'attack':192C 'attribut':159C,182C 'back':157C 'block':116C 'bodi':142C 'break':169C 'bundl':120C 'ccpa':77C 'comment':107C,134C,218C,223C 'complianc':74C 'consent':79C 'cooki':78C,115C 'cross':89C 'cross-sit':88C 'default':222C 'determinist':145C 'dom':123C,137C 'due':101C 'element':175C 'escap':164C 'execut':202C 'filter':131C 'first':215C 'gdpr':76C 'html':111C,122C,136C 'includ':97C 'inject':178C,194C,208C 'insid':112C 'iub':114C 'iub-cookie-block':113C 'iubenda':69C 'iubendapars':105C 'key':146C 'kses':130C 'kses-filt':129C 'later':152C 'make':187C 'marker':117C 'match':155C 'moder':217C 'nois':140C,147C,151C 'one':73C 'otherwis':216C 'page':199C,209C 'pars':106C 'parser':124C 'payload':170C 'plugin':81C 'possibl':189C 'previous':224C 'process':110C 'quot':168C 'quote-break':167C 're':109C,163C 're-escap':162C 're-process':108C 'remov':139C 'render':184C 'restor':150C 'save':133C 'script':91C,197C 'set':226C 'simpl':121C,135C 'site':90C 'stash':171C 'store':87C,141C 'substitut':153C 'substr':156C 'time':185C 'unauthent':191C 'user':205C 'valu':160C 'version':93C 'vulner':85C 'way':104C 'web':196C 'whenev':203C 'without':161C 'wordpress':83C,126C,220C","first_public_at":"2026-11-07T03:17:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120540","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120540","severity":null,"published_at":"2026-11-07T03:17:03+00:00","modified_at":"2026-11-07T03:17:03+00:00","first_seen_at":"2026-11-07T03:45:35+00:00","fetched_at":"2026-11-07T03:45:35+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}