Gdpr Data Request Form Vulnerabilities

The GDPR Data Request Form plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 1.5 through 1.7.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can tric...

CVSS:

4.3

(Wordfence)

Affected:

1.5 – 1.7.1

Fix:

No patched version reported

Disclosed:

Oct 6, 2026

CVE-2026-85348 on NVD →

The GDPR Data Request Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form_id parameter in versions up to, and including, 1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject...

CVSS:

6.4

(Wordfence)

Affected:

up to 1.6

Fixed in:

1.7

Disclosed:

Feb 2, 2024

CVE-2024-24836 on NVD →