CVE-2026-77233: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in iubenda iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more

CVE-2026-77233 is a stored Cross-Site Scripting vulnerability in the iubenda WordPress plugin for GDPR/CCPA compliance, affecting all versions up to 3.13.4. The issue is due to improper neutralization of input during web page generation, specifically in the Comment Content via AdSense Regex Rewrite functionality. This allows unauthenticated attackers to inject malicious scripts that execute in the context of users visiting the compromised pages. The vulnerability only manifests when the 'Secondary' parser engine is enabled (parser_engine=default) and is not present when using the default 'new' DOM-based parser engine.

Successful exploitation allows an unauthenticated attacker to perform stored XSS attacks, potentially leading to the execution of arbitrary scripts in the browsers of users visiting affected pages. This can result in information disclosure and limited integrity impact. The vulnerability does not affect availability. The CVSS v3.1 base score is 7.2 (High), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and scope change.

No official patch or fix is currently documented. Users should disable the 'Secondary' parser engine (parser_engine=default) and use the default 'new' DOM-based parser engine to avoid exposure. Monitor the vendor's advisory for updates or patches addressing this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.