CVE-2026-77233 Overview
CVE-2026-77233 is a Stored Cross-Site Scripting (XSS) vulnerability in the iubenda All-in-one Compliance for GDPR / CCPA Cookie Consent WordPress plugin. The flaw affects all versions up to and including 3.13.4. It stems from insufficient input sanitization and output escaping in the AdSense regex rewrite logic applied to comment content. Unauthenticated attackers can inject arbitrary web scripts through comment content, which execute when users visit affected pages. The vulnerability only manifests when the Secondary parser engine is active (parser_engine=default) and does not exist under the default new DOM-based parser engine. The issue is tracked under [CWE-79].
Critical Impact
Unauthenticated attackers can store JavaScript payloads that execute in visitors' browsers, enabling session theft, credential harvesting, and site defacement on WordPress sites running the vulnerable plugin with the Secondary parser engine enabled.
Affected Products
- iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress, versions up to and including 3.13.4
- Only affected when parser_engine=default (Secondary parser engine) is active
- Not affected: installations using the default new DOM-based parser engine
Discovery Timeline
- 2026-09-05 - CVE-2026-77233 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-77233
Vulnerability Analysis
The vulnerability resides in the iubenda plugin's AdSense regex rewrite functionality, which processes comment content before rendering. When the Secondary parser engine (parser_engine=default) is active, the regex-based rewrite path processes user-controlled comment data without adequately sanitizing input or escaping output. This allows attacker-supplied script content to survive processing and be delivered to page viewers as executable JavaScript.
Because comments on many WordPress sites accept unauthenticated submissions, no privileges or user interaction are required to plant the payload. The stored nature of the flaw means every visitor loading the injected page triggers script execution in their browser session.
The scope-changed impact reflects that scripts execute in the context of the vulnerable site, allowing an attacker to reach resources beyond the injection point. Typical outcomes include theft of session cookies, forced actions against authenticated administrators, redirection to attacker infrastructure, and browser-based cryptojacking. Per FIRST's EPSS model, the vulnerability carries a probability of 0.292% (21.622 percentile) as of 2026-09-11.
Root Cause
The root cause is regex-based content rewriting that treats HTML as text. The AdSense rewrite paths in iubenda.class.php around lines 557 and 570, and the cookie solution logic in iubenda_cookie_solution.php around line 986, apply pattern-based substitution to comment content without HTML-aware sanitization or contextual output escaping. Regex-based HTML manipulation cannot reliably distinguish safe markup from attacker-controlled script vectors, producing an [CWE-79] Improper Neutralization of Input During Web Page Generation condition.
Attack Vector
An unauthenticated remote attacker submits a comment containing a crafted payload designed to survive the AdSense regex rewrite. Once stored, the payload renders on any page that displays the comment and executes in the browser of every visitor. On sites where site administrators view comments in the admin interface, the payload can execute in a privileged context and pivot to administrative actions.
The vulnerability manifests only when the Secondary parser engine is configured (parser_engine=default). Sites using the default new DOM-based parser engine are not exposed. Refer to the Wordfence Vulnerability Intelligence entry and the WordPress Changeset #3675630 for the corrective patch details.
Detection Methods for CVE-2026-77233
Indicators of Compromise
- Comment records in the WordPress wp_comments table containing <script>, onerror=, onload=, or javascript: payloads
- Outbound browser requests from site visitors to unfamiliar third-party domains after page load
- Unexpected administrator account creations or role changes correlated with admin visits to comment moderation pages
- Plugin configuration showing parser_engine=default while running iubenda plugin version 3.13.4 or earlier
Detection Strategies
- Query the WordPress database for stored comments containing HTML event handlers or script tags, focusing on entries created before patching
- Deploy Content Security Policy (CSP) reporting to surface script executions from unauthorized inline sources or external domains
- Monitor web server access logs for POST requests to wp-comments-post.php containing encoded script fragments or suspicious payload patterns
Monitoring Recommendations
- Alert on new plugin installations or version changes for iubenda-cookie-law-solution and inventory sites still on version 3.13.4 or below
- Track changes to the plugin's parser_engine setting and flag reversions to default
- Correlate administrator session anomalies (new devices, unexpected geolocation, elevated privilege changes) with recent comment moderation activity
How to Mitigate CVE-2026-77233
Immediate Actions Required
- Upgrade the iubenda plugin to version 3.13.5 or later on all WordPress installations
- If patching is not immediately possible, switch the plugin's parser configuration from parser_engine=default (Secondary) to the default new DOM-based parser engine
- Audit existing comments for injected script content and purge malicious entries before restoring public rendering
- Rotate WordPress administrator credentials and invalidate active sessions if injected payloads are found
Patch Information
The vendor addressed the issue in version 3.13.5. The fix is applied in WordPress Changeset #3675630. A full diff between the vulnerable and fixed releases is available in the 3.13.4 to 3.13.5 changeset comparison. Administrators should verify the plugin version post-upgrade and confirm the AdSense rewrite paths reflect the patched logic.
Workarounds
- Set the plugin's parser engine to the new DOM-based parser, which does not contain the vulnerable code path
- Disable public comment submissions or require authentication and manual moderation until the upgrade is applied
- Deploy a Web Application Firewall (WAF) rule to block comment submissions containing script tags or common XSS event handlers
- Enforce a restrictive Content Security Policy that disallows inline scripts and untrusted script sources across the site
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.