CVE-2026-77263: iubenda WordPress Plugin XSS Vulnerability

CVE-2026-77263 Overview

CVE-2026-77263 is a stored Cross-Site Scripting (XSS) vulnerability in the iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress. The flaw affects all versions up to and including 3.13.4. Unauthenticated attackers can inject arbitrary JavaScript through comment content that executes in the browser of any visitor, including logged-in administrators. The root issue is insufficient input sanitization and output escaping combined with a global strtr() substitution that mutates KSES-allowed markup into executable HTML. The vulnerability is tracked under [CWE-79].

Critical Impact
Unauthenticated attackers can plant persistent JavaScript in WordPress pages, enabling session theft, administrative account takeover, and arbitrary actions within the WordPress origin.

Affected Products

iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more (WordPress plugin)
All versions up to and including 3.13.4
Fixed in version 3.13.5

Discovery Timeline

2026-09-05 - CVE-2026-77263 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-77263

Vulnerability Analysis

The vulnerability lives in how the iubenda plugin post-processes comment content before rendering. WordPress normally applies KSES filtering to strip disallowed HTML from user-submitted comments. The plugin then runs a global strtr() substitution against the already-sanitized output. This substitution removes specific substrings from HTML that KSES considered inert, such as abbr tags with title attributes and HTML comments. When those substrings are stripped, the surrounding markup collapses into a new tag boundary that KSES never had the chance to evaluate. The result is stored HTML that executes in the WordPress origin for every visitor who loads the affected page.

Root Cause

The root cause is applying transformation logic after sanitization. KSES enforces an allow-list on submission, but the plugin's strtr() pass mutates the sanitized output in iubenda.class.php and iubenda_cookie_solution.php. See the vulnerable code paths at iubenda.class.php L381, iubenda.class.php L941, iubenda_cookie_solution.php L834, and iubenda_cookie_solution.php L857. Because escaping is not re-applied after the substitution, an attacker controls the final rendered HTML.

Attack Vector

An unauthenticated attacker submits a blog comment containing an inert tag such as abbr title="..." wrapped around markup fragments and HTML comments. When the plugin runs its substitution, the removed characters cause the fragments to concatenate into an executable element, for example an img tag with an onerror handler. The injected script runs whenever any user loads the page, including administrators viewing the comment moderation queue. This grants the attacker the ability to steal session cookies, perform administrative actions, or pivot to further compromise.

Code-level exploitation details are not published as a public proof of concept. The vulnerable and patched code is documented in WordPress Changeset #3675630 and the 3.13.4 to 3.13.5 diff.

Detection Methods for CVE-2026-77263

Indicators of Compromise

Comments in wp_comments containing abbr tags with title attributes combined with HTML comment sequences ().
Rendered pages that contain onerror, onload, or onmouseover handlers within comment output.
Unexpected outbound requests from administrator browsers to attacker-controlled domains after loading comment pages.
New administrator accounts or modified user roles following comment activity from unauthenticated sources.

Detection Strategies

Query the wp_comments table for suspicious markup patterns such as title=, <!--, or event handler attributes in comment_content.
Compare the plugin file hashes against the fixed 3.13.5 release to confirm no tampering.
Review web server access logs for POST requests to wp-comments-post.php containing encoded HTML payloads.

Monitoring Recommendations

Enable file integrity monitoring on the wp-content/plugins/iubenda-cookie-law-solution/ directory.
Alert on browser-side script execution originating from /comments or single-post URLs.
Correlate administrator session anomalies with recent comment submissions from unauthenticated visitors.

How to Mitigate CVE-2026-77263

Immediate Actions Required

Update the iubenda Cookie Consent plugin to version 3.13.5 or later on every WordPress site.
Audit existing comments for suspicious markup and remove or unapprove any that contain event handlers or abbr title constructs paired with HTML comments.
Rotate administrator credentials and invalidate active sessions if injected content was rendered to logged-in users.

Patch Information

The vendor released version 3.13.5, which corrects the sanitization order so that KSES-allowed markup is no longer mutated into executable HTML. Refer to the WordPress Changeset Comparison 3.13.4 to 3.13.5 and the Wordfence Vulnerability Report for full remediation details.

Workarounds

Deactivate the iubenda Cookie Consent plugin until the update to 3.13.5 can be applied.
Disable public comments or require registered user authentication for comment submission.
Deploy a Web Application Firewall (WAF) rule that blocks comment payloads containing abbr tags paired with HTML comments or on-event attributes.
Enforce a strict Content Security Policy (CSP) that disallows inline event handlers and unsafe inline scripts.

bash

# Configuration example: WP-CLI update to the patched release
wp plugin update iubenda-cookie-law-solution --version=3.13.5
wp plugin status iubenda-cookie-law-solution