VulnSocial

CVE-2026-77233Disclosure

LOWCVSS 7.2 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite in all versions up to, and including, 3.13.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability only manifests when the 'Secondary' parser engine is active (parser_engine=default); it does not exist under the default 'new' DOM-based parser engine.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-09-07: 1Technical Details · 2026-09-07: 109-07
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
Full discourse1 post
  • Ciberseguridad LATAM@CibersegLATAM
    Disclosure

    🚨 Falla XSS en plugin de cumplimiento GDPR expone sitios WordPress con configuración heredada CVE-2026-77233 permite inyección de scripts sin autenticación en iubenda, pero solo afecta instalaciones que mantienen el parser… ¿Ya lo tienen en el radar? https://ciberseguridadlatam.com/falla-xss-en-plugin-de-cumplimiento-gdpr-expone-sitios-wordpress-con-configuracion-heredada/?utm_source=x&utm_medium=social&utm_campaign=falla-xss-en-plugin-de&utm_content=post https://t.co/JhVV9hxR4i

    Post summary

    The post reports an unauthenticated XSS flaw (CVE‑2026‑77233) in the iubenda GDPR compliance plugin that affects WordPress sites using legacy parser configurations, with no PoC, exploit, patch, or active exploitation mentioned.

    01011599
    22.6K followersView on X

Explore more

Back to dashboard