Stored Cross-Site Scripting in iubenda Cookie Consent Plugin for WordPress
CVE-2026-120540
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 7 November 2026
What is CVE-2026-120540?
The iubenda Cookie Consent Plugin for WordPress is susceptible to stored cross-site scripting (XSS). This vulnerability arises from how the iubendaParser::parse_comments() method processes HTML inside IUB-COOKIE-BLOCK markers using the simple_html_dom parser after comments have been KSES-filtered by WordPress. The parser's remove_noise() function stores bodies under a deterministic key and later uses restore_noise() to substitute matching substrings back into attribute values without re-escaping them. Consequently, a quote-breaking payload can be injected into an allowed attribute at render time, permitting unauthenticated users to execute arbitrary web scripts on pages viewed by users, post approval of a previously moderated comment.
Affected Version(s)
iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more 0 <= 3.13.6