CVE-2026-86606
iubenda < 3.13.7 - Unauthenticated Stored XSS via Cookie Block HTML Parser
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more WordPress plugin before 3.13.7 does not properly escape content it re-emits through its bundled HTML parser, allowing unauthenticated users to inject arbitrary web scripts in pages that will execute in the session of any visitor viewing them, including logged in administrators.
| Vendor | unknown |
| Product | iubenda | all-in-one compliance for gdpr / ccpa cookie consent + more |
| Published | Nov 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown iubenda | all-in-one compliance for gdpr / ccpa cookie consent + more
Be the first to know when new unknown vulnerabilities affecting unknown iubenda | all-in-one compliance for gdpr / ccpa cookie consent + more are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more
0 < 3.13.7
References
Credits
Jakub Herman WPScan