Wordpress Gdpr Vulnerabilities

The WordPress GDPR plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr_firstname' and 'gdpr_lastname' parameters in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary we...

CVSS:

7.2

Affected:

up to 2.0.2

Fixed in:

2.0.3

Disclosed:

Nov 17, 2024

CVE-2024-10388 on NVD →

The WordPress GDPR plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'WordPress_GDPR_Data_Delete::check_action' function in all versions up to, and including, 2.0.2. This makes it possible for unauthenticated attackers to delete arbitrary users.

CVSS:

6.5

Affected:

up to 2.0.2

Fixed in:

2.0.3

Disclosed:

Nov 17, 2024

CVE-2024-11069 on NVD →

The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.27, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web browser led to this end...

CVSS:

6.5

Affected:

up to 1.9.27

Fixed in:

1.9.27

Disclosed:

Jan 26, 2022

CVE-2022-0220 on NVD →

The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.26, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web browser led to this end...

CVSS:

6.1

Affected:

up to 1.9.26

Fixed in:

1.9.27

Disclosed:

Jan 26, 2022

CVE-2021-24814 on NVD →