iubenda All-in-one Compliance: Stored Cross-Site Scripting (CVE-2026-120540)

The iubenda All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress (versions <= 3.13.6) is susceptible to stored Cross-Site Scripting (XSS). The vulnerability stems from the iubendaParser::parse_comments() function, which uses the simple_html_dom library to re-process HTML within IUB-COOKIE-BLOCK markers. The library's remove_noise() and restore_noise() logic replaces specific content (such as <code> bodies) with deterministic keys. If the content is restored into an attribute value without re-escaping, an attacker can break out of the attribute context to execute arbitrary JavaScript.

Attack Chain

1. An unauthenticated attacker submits a WordPress comment containing a malicious payload inside a <code> element, wrapped in IUB-COOKIE-BLOCK markers.
2. WordPress performs initial KSES filtering on the comment body.
3. The plugin triggers iubendaParser::parse_comments() on the saved comment.
4. The simple_html_dom library's remove_noise() function processes the comment and stores the payload content using a deterministic noise key.
5. The library's restore_noise() function later substitutes the noise key back into the output, including into HTML attribute values.
6. The payload, which effectively broke out of the attribute's quote context, is rendered in the page by the server.
7. A victim user (such as an administrator) views the comment, triggering the injected script.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary web scripts in the browser of any user who accesses an affected page, including administrators. This can lead to account takeover, unauthorized actions performed on behalf of the victim, or session theft.

Recommendation

• Update the "iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more" plugin to the latest version available that incorporates a fix for CVE-2026-120540.
• Implement a Web Application Firewall (WAF) rule to block POST requests containing common XSS vectors or suspicious use of < and > characters within comment submissions if immediate patching is not possible.
• Audit existing comment sections for unexpected script tags or attribute injections if the plugin has been used extensively on high-traffic sites.