iubenda WordPress plugin stored XSS flaw
Anyone can plant malicious scripts in this cookie consent plugin to steal visitor accounts.
Summary
The iubenda WordPress plugin does not escape content its bundled HTML parser outputs, so unauthenticated users can inject scripts. Those scripts run in the sessions of visitors, including logged-in administrators, and versions before 3.13.7 are affected.
What to do
Update to iubenda 3.13.7 or later. Versions before 3.13.7 are affected.
Products and platforms
CVE IDs
Sources
- Write-up: wpscan.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen