Fixed Advanced Cookie consent rendered in RSS

[Kirby]

Affected version

2.3.10

When XenForo rends BBCode into HTML for RSS int might inject coe for cookie Consent:

<item>
      <title>XF2 [8WR] XenRio 2 (Streams) PRO [Paid]</title>
      <pubDate>Sun, 22 Mar 2026 20:39:01 +0000</pubDate>
      <link>https://xenforo.com/community/threads/xf2-8wr-xenrio-2-streams-pro-paid.140206/</link>
      <guid isPermaLink="false">140206</guid>
      <author>invalid@example.com (Jaxel)</author>
      <category domain="https://xenforo.com/community/forums/add-on-releases-2-x.95/"><![CDATA[Add-on releases [2.x]]]></category>
      <dc:creator>Jaxel</dc:creator>
      <content:encoded><![CDATA[<div class="bbWrapper">Jaxel submitted a new resource:<br />
<br />
<a href="https://xenforo.com/community/resources/xf2-8wr-xenrio-2-streams-pro.6024/" class="link link--internal">XF2 [8WR] XenRio 2 (Streams) PRO</a> - Live stream scraper and browser. Add-on from 8WAYRUN.<br />
<br />




<blockquote data-attributes="" data-quote="" data-source=""
    class="bbCodeBlock bbCodeBlock--expandable bbCodeBlock--quote js-expandWatch">
   
    <div class="bbCodeBlock-content">
       
        <div class="bbCodeBlock-expandContent js-expandContent ">
            <b><span style="color: rgb(184, 49, 47)">BRANDING REMOVAL</span></b> can be purchased <a href="http://8wayrun.fetchapp.com/sell/752f3415" target="_blank" class="link link--external" rel="nofollow ugc noopener"><b>HERE</b></a>:<br />
<br />
This is a complete rewrite of my popular live streaming scraper for XenForo. XenRio periodically scrapes various APIs in order to keep your users informed of the currently live broadcasts relevant to your community. <br />
<br />
<b>Demo</b>:<br />
<br />
<div style="margin-left: 40px"><form action="/community/misc/cookies?update=1&amp;add=1" method="post" class="bbMediaJustifier"
                 data-xf-init="cookie-consent-form ajax-submit" data-redirect="off" data-media-site-id="youtube" data-media-key="guJK3MgvZQE"
            >
                <input type="hidden" name="_xfToken" value="1774272202,dd9e6d6918d2066b8509f74dc0e7d3b6" />
               

        <div class="block-rowMessage block-rowMessage--alt">
            <div class="u-dimmed u-smaller">
                To view this content we will need your consent to set third party cookies.<br>
For more detailed information, see our <a href="/community/help/cookies">cookies page</a>.

            </div>
            <div class="u-inputSpacer">
                <button type="submit" class="button button--small"><span class="button-text">Accept third party cookies</span></button>
            </div>

            <input type="hidden" name="consent[_third_party]" value="1" />
            <input type="hidden" name="_xfRedirect" value="" />
        </div>

       
            <template class="js-embedHtml"><div class="bbMediaWrapper" data-media-site-id="youtube" data-media-key="guJK3MgvZQE">
    <div class="bbMediaWrapper-inner">
        <iframe src="https://www.youtube.com/embed/guJK3MgvZQE?wmode=opaque"
                loading="lazy"
                width="560" height="315"
                frameborder="0" allowfullscreen="true"></iframe>
    </div>
</div></template>
       

            </form>&#8203;</div><br />
<b>Basic...</b>
        </div>
        <div class="bbCodeBlock-expandLink js-expandLink"><a role="button" tabindex="0">Click to expand...</a></div>
    </div>
</blockquote><br />
<a href="https://xenforo.com/community/threads/xf2-8wr-xenrio-2-streams-pro-paid.140206/" class="link link--internal">Read more</a></div>]]></content:encoded>
      <slash:comments>766</slash:comments>
    </item>

Specifically this part

<div style="margin-left: 40px"><form action="/community/misc/cookies?update=1&amp;add=1" method="post" class="bbMediaJustifier"
                 data-xf-init="cookie-consent-form ajax-submit" data-redirect="off" data-media-site-id="youtube" data-media-key="guJK3MgvZQE"
            >
                <input type="hidden" name="_xfToken" value="1774272202,dd9e6d6918d2066b8509f74dc0e7d3b6" />
               

        <div class="block-rowMessage block-rowMessage--alt">
            <div class="u-dimmed u-smaller">
                To view this content we will need your consent to set third party cookies.<br>
For more detailed information, see our <a href="/community/help/cookies">cookies page</a>.

            </div>
            <div class="u-inputSpacer">
                <button type="submit" class="button button--small"><span class="button-text">Accept third party cookies</span></button>
            </div>

            <input type="hidden" name="consent[_third_party]" value="1" />
            <input type="hidden" name="_xfRedirect" value="" />
        </div>

       
            <template class="js-embedHtml"><div class="bbMediaWrapper" data-media-site-id="youtube" data-media-key="guJK3MgvZQE">
    <div class="bbMediaWrapper-inner">
        <iframe src="https://www.youtube.com/embed/guJK3MgvZQE?wmode=opaque"
                loading="lazy"
                width="560" height="315"
                frameborder="0" allowfullscreen="true"></iframe>
    </div>
</div></template>
       
   
               
            </form>

obviously doesn't work as URLs like /community/help/cookie are relative, there is no XenForo JS, etc.

Suggested Fix
Ignore consent status when rendering for RSS and render as if consented.

 

[XF Bug Bot]

Thank you for reporting this issue, it has now been resolved. We are aiming to include any changes that have been made in a future XF release (2.3.11).

Change log:

Suppress the third-party cookie consent form in the HTML BB code renderer when the noCookieConsent option is set and enable that option for thread RSS feeds so embedded media renders without the interactive consent UI that has no place in a feed reader.

There may be a delay before changes are rolled out to the XenForo Community.