iubenda cookie consent WordPress plugin stored XSS flaw
Visitors to sites using this WordPress cookie plugin can be hacked.
Summary
A flaw in how the iubenda cookie consent WordPress plugin handles comments lets an unauthenticated attacker place malicious web scripts on pages. Versions up to and including 3.13.6 are affected, and the scripts run in visitors' browsers once an administrator approves the first comment.
Affected when
- WordPress default comment setting (comment_previously_approved)
- An administrator approves the first comment
What to do
Check that the plugin runs a version newer than 3.13.6, and read the vendor's advisory.
Products and platforms
CVE IDs
Times
First published
First seen