CVE-2026-77233 iubenda CVE debrief

Who should care

Defenders responsible for WordPress installations using the iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin, especially those with the 'Secondary' parser engine active, should assess their exposure and verify the presence of this vulnerability.

Why it matters

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations, especially if the 'Secondary' parser engine is active, and ensure that input sanitization and output escaping are properly implemented.

• Unauthenticated attackers can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
• The vulnerability only manifests when the 'Secondary' parser engine is active.

Technical summary

The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content due to insufficient input sanitization and output escaping. The vulnerability only manifests when the 'Secondary' parser engine is active. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations, especially if the 'Secondary' parser engine is active, and ensure that input sanitization and output escaping are properly implemented.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations, especially if the 'Secondary' parser engine is active, and ensure that input sanitization and output escaping are properly implemented.

Recommended defensive actions

• Verify the presence of this vulnerability in your WordPress installations, especially if the 'Secondary' parser engine is active.
• Ensure that input sanitization and output escaping are properly implemented.
• Review and update the plugin to the latest version if necessary.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD vulnerability detail provide information on the vulnerability, including its description, CVSS score, and affected versions. Additional details are available in the source references provided by [email protected].

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.