CVE-2026-77263: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in iubenda iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more

CVE-2026-77263 is a stored cross-site scripting vulnerability in the iubenda WordPress plugin for GDPR/CCPA compliance, affecting all versions up to and including 3.13.4. The flaw is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of comment content. Attackers can submit specially crafted comments containing KSES-allowed markup that, after global string substitutions, mutate inert HTML tags into executable elements such as img tags with onerror handlers. This results in arbitrary script execution in the context of any user viewing the injected page, including logged-in administrators. The vulnerability has a CVSS 3.1 score of 7.2 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity with scope change.

An unauthenticated attacker can inject persistent malicious scripts into comment content, which execute in the security context of any user visiting the affected page, including administrators. This can lead to theft of sensitive information, session hijacking, or other malicious actions within the WordPress origin. The vulnerability compromises confidentiality and integrity but does not affect availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling comments or implementing additional input sanitization and output escaping controls on comment content to mitigate exploitation risk.