The WordPress plugin "iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more" is vulnerable to a stored cross‑site scripting flaw in versions up to and including 3.13.6. The flaw arises because the iubendaParser::parse_comments() function re‑processes HTML within IUB-COOKIE-BLOCK markers using bundled simple_html_dom after WordPress has applied its KSES filter to the comment. The parser’s remove_noise() function preserves <code> elements under a deterministic key, and restore_noise() later inserts matching substrings back into attribute values without re‑escaping. This allows an attacker to embed a quote‑breaking payload inside an allowed <code> element that is later injected into an allowed <abbr> attribute at render time, creating arbitrary script execution on pages after a moderator approves the comment.

This vulnerability affects the WordPress plugin "iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more" supplied by iubenda. It is present in all releases up to and including version 3.13.6.

The reported CVSS score of 7.2 indicates a high impact vulnerability. While EPSS is not available and the issue is not listed in CISA’s KEV catalog, the attacker does not need credentials to exploit the flaw; any unauthenticated user can submit a malicious comment that, once approved by an administrator’s default moderation setting, will execute embedded scripts in the browsers of any visitor to the affected page. The exploitation path requires only comment posting and subsequent admin approval, making the risk significant for sites that allow publicly editable comments on the plugin’s pages.