CVE-2026-86606 Details
Description
The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more WordPress plugin before 3.13.7 does not properly escape content it re-emits through its bundled HTML parser, allowing unauthenticated users to inject arbitrary web scripts in pages that will execute in the session of any visitor viewing them, including logged in administrators.
A stored cross-site scripting vulnerability has been identified in the iubenda WordPress plugin, specifically in versions prior to 3.13.7. The issue arises because the plugin fails to properly escape content before it is processed by its integrated HTML parser. This flaw allows unauthenticated users to inject arbitrary web scripts into pages, which are then executed in the context of any visitor viewing those pages, including logged-in administrators.
Users are advised to update the iubenda WordPress plugin to version 3.13.7 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 6, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/69414165-8cb3-4c42-baec-235b0d80f9c0/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| iubenda | < 3.13.7 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Nov 6, 2026 | New CVE Received | [email protected] |