Malicious Javascript Injection

Hi Salvatore,

Thank you for your detailed report!

Regarding the reports received by your users, we can assure you that if you’re using any version greater than 3.3.3 your website is safe. Please note that you may also encounter recent notices saying that more recent versions of our plugin still has a security vulnerability, but they are just incorrect statements.

For reference, you can find here a previous question about this topic: https://www.ads-software.com/support/topic/security-vulnerability-and-versions/#post-16339942

In particular, the links with the vulnerability reporting a wrong version were:

1. https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/iubenda-cookie-law-solution/iubenda-357-reflected-cross-site-scripting
2. https://patchstack.com/database/vulnerability/iubenda-cookie-law-solution/wordpress-iubenda-plugin-3-5-7-reflected-xss-vulnerability

As you can note, they deleted them, and the URL are not reachable. 

As said, the iubenda plugin had a vulnerability prior to v3.3.3, that has been fixed with version 3.3.3 (or higher) but we can’t confirm that your specific injection was caused by the previous vulnerability.

In any case, we recommend:

• To review all the registered users with admin privilege/access on your website;
• To clean plugin data/storage, you can click on “Plugin settings” (https://prnt.sc/Il3wwMKKDM7w), select “delete all plugin data upon deactivation” (https://prnt.sc/jPPrEbu6IPaD), then go back to the Plugins page (https://prnt.sc/MpwE8xTfY-Za )?and disable our plugin;
• Update our plugin to the latest version and reconfigure it;

Hope this helps!