Unauthenticated attackers can exploit this by submitting specially crafted comment content that includes malicious JavaScript. When an administrator or other user views the affected page where the injected comment is rendered, the script executes within the context of their session. This can lead to session hijacking, unauthorized actions performed on behalf of the victim, or credential theft. The vulnerability does not exist when the default 'new' DOM-based parser engine is in use, making it critical for administrators to verify their parser configuration and update the plugin.

Impact

The successful exploitation of this vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user viewing the injected content. This poses a significant risk to the integrity and confidentiality of user sessions, particularly those of administrative users who frequently interact with site comments and moderation panels. If an administrator is targeted, the attacker could potentially take full control of the WordPress instance.

Recommendation

• Update the iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin to the latest version immediately.
• Review plugin settings in the WordPress dashboard to ensure the 'Secondary' parser engine is disabled, or switch to the 'new' DOM-based parser engine if possible.
• Monitor web application firewall logs for common XSS payloads (e.g., <script>, onload=, onerror=) directed at WordPress comment submission endpoints.