CVE-2026-77233

The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress (all versions up to and including 3.13.4) fails to adequately sanitize and escape comment content when processing it through its AdSense Regex Rewrite, allowing unauthenticated attackers to inject arbitrary web scripts into pages. The flaw only manifests on sites where the 'Secondary' parser engine is active (parser_engine=default); sites using the default 'new' DOM-based parser engine are not affected. An attacker who submits a crafted comment can have their script execute in the browser of any user who views the injected page, potentially hijacking sessions, stealing cookies, or performing actions as the victim. Any WordPress site running the vulnerable plugin versions with the Secondary parser engine enabled is affected. No public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation is known, and EPSS estimates only a 0.3% probability of exploitation within 30 days.

What to do: Update the iubenda plugin to a patched release newer than 3.13.4 as soon as one is available. As an interim mitigation, switch the parser engine to the default 'new' DOM-based engine rather than parser_engine=default, and review submitted comments for injected scripts or markup, moderating/removing any suspicious content.