CVE-2026-77263

CVE-2026-77263 is a stored cross-site scripting vulnerability in the iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more WordPress plugin, present in all versions up to and including 3.13.4 because comment content is insufficiently sanitized and escaped on output. An unauthenticated visitor can post a comment containing KSES-allowed markup (such as abbr title attributes and HTML comments); the plugin's global strtr() substitution strips substrings from an inert tag, mutating it into an executable element such as an img tag with an onerror handler. The injected script then executes in the affected site's origin whenever any visitor, including logged-in administrators, loads the injected page, allowing the attacker to run arbitrary web script as that user (e.g., perform admin actions or alter site content). Any WordPress site running the plugin is affected, with the highest risk on sites that accept comments from unauthenticated visitors. No public proof-of-concept, CISA KEV listing, or known exploitation is reported, and EPSS assigns roughly a 0.2% probability of exploitation within 30 days.

What to do: Update the plugin to the latest fixed release (any version after 3.13.4) from the WordPress plugin directory. Until patched, hold new comments for moderation or disable unauthenticated commenting so anonymous visitors cannot inject markup, and review recently posted comments for abbr tags or HTML comments that could be mutated into executable elements. Since no public exploit is known, patch within normal high-severity patch cycles rather than emergency timelines.