CVE-2026-86606: high-severity vulnerability in iubenda | All-in-one Compliance for GDPR /…
iubenda < 3.13.7 - Unauthenticated Stored XSS via Cookie Block HTML Parser
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
41Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 7.5epss 0.2%
The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more WordPress plugin before 3.13.7 does not properly escape content it re-emits through its bundled HTML parser, allowing unauthenticated users to inject arbitrary web scripts in pages that will execute in the session of any visitor viewing them, including logged in administrators.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
public PoCs found — 1
cve_referencewpscan.com/vulnerability/69414165-8cb3-4c42-baec-235b0d80f9c0/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — iubenda | All-in-one Compliance for GDPR /…
In the same product, most dangerous first.