Attack Chain

1. An unauthenticated attacker submits a WordPress comment containing a malicious payload inside a <code> element, wrapped in IUB-COOKIE-BLOCK markers.
2. WordPress performs initial KSES filtering on the comment body.
3. The plugin triggers iubendaParser::parse_comments() on the saved comment.
4. The simple_html_dom library's remove_noise() function processes the comment and stores the payload content using a deterministic noise key.
5. The library's restore_noise() function later substitutes the noise key back into the output, including into HTML attribute values.
6. The payload, which effectively broke out of the attribute's quote context, is rendered in the page by the server.
7. A victim user (such as an administrator) views the comment, triggering the injected script.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary web scripts in the browser of any user who accesses an affected page, including administrators. This can lead to account takeover, unauthorized actions performed on behalf of the victim, or session theft.

Recommendation

• Update the "iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more" plugin to the latest version available that incorporates a fix for CVE-2026-120540.
• Implement a Web Application Firewall (WAF) rule to block POST requests containing common XSS vectors or suspicious use of < and > characters within comment submissions if immediate patching is not possible.
• Audit existing comment sections for unexpected script tags or attribute injections if the plugin has been used extensively on high-traffic sites.