Stored Cross-Site Scripting in iubenda WordPress Plugin

The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 3.13.4. The vulnerability arises from insufficient input sanitization and output escaping within the plugin's handling of comment content via the AdSense Regex Rewrite functionality. This flaw is specifically triggered when the 'Secondary' parser engine is active (parser_engine=default).

Unauthenticated attackers can exploit this by submitting specially crafted comment content that includes malicious JavaScript. When an administrator or other user views the affected page where the injected comment is rendered, the script executes within the context of their session. This can lead to session hijacking, unauthorized actions performed on behalf of the victim, or credential theft. The vulnerability does not exist when the default 'new' DOM-based parser engine is in use, making it critical for administrators to verify their parser configuration and update the plugin.

Impact

The successful exploitation of this vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user viewing the injected content. This poses a significant risk to the integrity and confidentiality of user sessions, particularly those of administrative users who frequently interact with site comments and moderation panels. If an administrator is targeted, the attacker could potentially take full control of the WordPress instance.

Recommendation

• Update the iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin to the latest version immediately.
• Review plugin settings in the WordPress dashboard to ensure the 'Secondary' parser engine is disabled, or switch to the 'new' DOM-based parser engine if possible.
• Monitor web application firewall logs for common XSS payloads (e.g., <script>, onload=, onerror=) directed at WordPress comment submission endpoints.