iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more Security & Risk Analysis

The iubenda-cookie-law-solution plugin version 3.13.1 exhibits a mixed security posture. While it demonstrates strong adherence to secure coding practices with a high percentage of properly escaped output and exclusively using prepared statements for SQL queries, significant concerns arise from its attack surface. A substantial portion of its AJAX handlers (17 out of 17) lack authorization checks, creating a large vector for potential unauthorized actions. The presence of 4 previously disclosed CVEs, although currently patched, indicates a historical pattern of vulnerabilities including missing authorization, CSRF, SSRF, and improper input validation, suggesting that recurring security flaws have been an issue in the past. The taint analysis showing flows with unsanitized paths is concerning, even without critical or high severity findings in this scan, as it points to potential weaknesses in how user-supplied data is handled.