Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-09
Iubenda Cookie Law Solution - Security Vulnerability (CVE-2026-120854)
Allocation of Resources Without Limits or Throttling vulnerability in iubenda iubenda iubenda-cookie-law-solution allows HTTP DoS.This issue affects iubenda: from n/a through 3.13.6.
PLUGIN
Iubenda Cookie Law Solution
CVE-2026-120854
Risk Score
Threat Entry
Updated 2026-11-07
Iubenda Cookie Law Solution - Security Vulnerability (CVE-2026-120540)
The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.13.6. This is due to the way iubendaParser::parse_comments() re-processes HTML inside IUB-COOKIE-BLOCK markers through the bundled simple_html_dom parser after WordPress has already KSES-filtered the saved comment: simple_html_dom's remove_noise() stores bodies under a deterministic key ('___noise___ 1000') and restore_noise() later substitutes any matching substring back into attribute values WITHOUT re-escaping, allowing a quote-breaking payload stashed in an allowed element to be injected into…
PLUGIN
Iubenda Cookie Law Solution
CVE-2026-120540
Risk Score
Threat Entry
Updated 2026-09-08
Iubenda Cookie Law Solution - Cross-Site Scripting (XSS) (CVE-2026-77263)
The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.13.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit works by embedding KSES-allowed markup such as abbr title attributes and HTML comments in a submitted comment so that the global strtr() substitution…
PLUGIN
Iubenda Cookie Law Solution
CVE-2026-77263
Risk Score
Threat Entry
Updated 2026-09-08
Iubenda Cookie Law Solution - Cross-Site Scripting (XSS) (CVE-2026-77233)
The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite in all versions up to, and including, 3.13.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability only manifests when the 'Secondary' parser engine is active (parser_engine=default); it does not exist under the default 'new' DOM-based…
PLUGIN
Iubenda Cookie Law Solution
CVE-2026-77233
Risk Score
Threat Entry
Updated 2026-06-17
Iubenda Cookie Law Solution - Cross-Site Request Forgery (CSRF) (CVE-2022-3911)
The iubenda WordPress plugin before 3.3.3 does does not have authorisation and CSRF in an AJAX action, and does not ensure that the options to be updated belong to the plugin as long as they are arrays. As a result, any authenticated users, such as subscriber can grant themselves any privileges, such as edit_plugins etc
PLUGIN
Iubenda Cookie Law Solution
CVE-2022-3911
Risk Score
Threat Entry
Updated 2026-06-17
Iubenda Cookie Law Solution - Server-Side Request Forgery (SSRF) (CVE-2020-12742)
The iubenda-cookie-law-solution plugin before 2.3.5 for WordPress does not restrict URL sanitization to http protocols.
PLUGIN
Iubenda Cookie Law Solution
CVE-2020-12742
Risk Score