CVE-2026-86606 · Package
NO FIX YET · SEE WHAT TO DO
The iubenda cookie consent WordPress plugin before 3.13.7 fails to escape content it re-emits through its bundled HTML parser. An unauthenticated attacker can inject JavaScript that runs in the browser of any visitor, including logged-in administrators.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the iubenda WordPress plugin before 3.13.7 are exposed, since the flaw is reachable without an account and the injected script runs for anyone who views the affected page, including administrators. Sites that do not use this plugin are not affected. The sources do not say which specific pages or inputs trigger the parser output.
Not affected if plugin-not-installed, version-3.13.7-or-later
Who cares iubenda, self-hosted, wordpress
wp-content/plugins/ (version in the plugin header).3.13.7 as affected.3.13.7 or later.The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more WordPress plugin before 3.13.7 does not properly escape content it re-emits through its bundled HTML parser, allowing unauthenticated users to inject arbitrary web scripts in pages that will execute in the session of any visitor viewing them, including logged in administrators.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.