Web Application Vulnerability in iubenda WordPress Plugin Affects Cookie Consent Feature
CVE-2026-86606
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 6 November 2026
Badges
What is CVE-2026-86606?
The iubenda plugin for WordPress versions prior to 3.13.7 contains a security flaw that fails to properly sanitize user input in its integrated HTML parser. This vulnerability enables unauthorized users to inject malicious scripts into web pages, which can be executed in the browser sessions of all visitors, including site administrators. An attack could lead to significant security breaches, making it essential for users to upgrade to the latest version to mitigate risks.
Affected Version(s)
iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more 0 < 3.13.7
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.