{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/all-in-one-compliance-for-gdpr-/-ccpa-cookie-consent-+-more--3.13.6/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:iubenda:all-in-one_compliance_for_gdpr_/_ccpa_cookie_consent_+_more:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-120540"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["All-in-one Compliance for GDPR / CCPA Cookie Consent + more (\u003c= 3.13.6)"],"_cs_severities":["high"],"_cs_tags":["wordpress","xss","web-application","cve-2026-120540"],"_cs_type":"advisory","_cs_vendors":["iubenda"],"content_html":"\u003cp\u003eThe iubenda All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress (versions \u0026lt;= 3.13.6) is susceptible to stored Cross-Site Scripting (XSS). The vulnerability stems from the \u003ccode\u003eiubendaParser::parse_comments()\u003c/code\u003e function, which uses the \u003ccode\u003esimple_html_dom\u003c/code\u003e library to re-process HTML within \u003ccode\u003eIUB-COOKIE-BLOCK\u003c/code\u003e markers. The library's \u003ccode\u003eremove_noise()\u003c/code\u003e and \u003ccode\u003erestore_noise()\u003c/code\u003e logic replaces specific content (such as \u003ccode\u003e\u0026lt;code\u0026gt;\u003c/code\u003e bodies) with deterministic keys. If the content is restored into an attribute value without re-escaping, an attacker can break out of the attribute context to execute arbitrary JavaScript.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated attacker submits a WordPress comment containing a malicious payload inside a \u003ccode\u003e\u0026lt;code\u0026gt;\u003c/code\u003e element, wrapped in \u003ccode\u003eIUB-COOKIE-BLOCK\u003c/code\u003e markers.\u003c/li\u003e\n\u003cli\u003eWordPress performs initial KSES filtering on the comment body.\u003c/li\u003e\n\u003cli\u003eThe plugin triggers \u003ccode\u003eiubendaParser::parse_comments()\u003c/code\u003e on the saved comment.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003esimple_html_dom\u003c/code\u003e library's \u003ccode\u003eremove_noise()\u003c/code\u003e function processes the comment and stores the payload content using a deterministic noise key.\u003c/li\u003e\n\u003cli\u003eThe library's \u003ccode\u003erestore_noise()\u003c/code\u003e function later substitutes the noise key back into the output, including into HTML attribute values.\u003c/li\u003e\n\u003cli\u003eThe payload, which effectively broke out of the attribute's quote context, is rendered in the page by the server.\u003c/li\u003e\n\u003cli\u003eA victim user (such as an administrator) views the comment, triggering the injected script.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to execute arbitrary web scripts in the browser of any user who accesses an affected page, including administrators. This can lead to account takeover, unauthorized actions performed on behalf of the victim, or session theft.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the \u0026quot;iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more\u0026quot; plugin to the latest version available that incorporates a fix for CVE-2026-120540.\u003c/li\u003e\n\u003cli\u003eImplement a Web Application Firewall (WAF) rule to block POST requests containing common XSS vectors or suspicious use of \u003ccode\u003e\u0026lt;\u003c/code\u003e and \u003ccode\u003e\u0026gt;\u003c/code\u003e characters within comment submissions if immediate patching is not possible.\u003c/li\u003e\n\u003cli\u003eAudit existing comment sections for unexpected script tags or attribute injections if the plugin has been used extensively on high-traffic sites.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T03:46:48Z","date_published":"2026-11-07T03:46:48Z","id":"https://feed.craftedsignal.io/briefs/2026-11-iubenda-xss/","summary":"The iubenda All-in-one Compliance plugin for WordPress up to version 3.13.6 is vulnerable to stored Cross-Site Scripting (XSS) due to insecure re-processing of HTML comments by its bundled simple_html_dom parser.","title":"iubenda All-in-one Compliance: Stored Cross-Site Scripting (CVE-2026-120540)","url":"https://feed.craftedsignal.io/briefs/2026-11-iubenda-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - All-in-One Compliance for GDPR / CCPA Cookie Consent + More (\u003c= 3.13.6)","version":"https://jsonfeed.org/version/1.1"}