PT-2026-137828

CVE-2026-86606

Published

2026-11-03

Updated

2026-11-06

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions iubenda WordPress plugin versions prior to 3.13.7

Description The plugin fails to properly escape content re-emitted through its bundled HTML parser due to insufficient input sanitization and output escaping. This allows unauthenticated users to perform Stored Cross-Site Scripting (XSS), where arbitrary web scripts are injected into pages and executed in the session of any visitor, including logged-in administrators.

Recommendations Update the plugin to version 3.13.7 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Jakub Herman

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers