CVE-2022-0220

The checkprivacysettings AJAX action of the WordPress GDPR WordPress plugin before 1.9.27, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web...

PT-2022-7141 · WordPress · Wordpress Gdpr Plugin

Name of the Vulnerable Software and Affected Versions: WordPress GDPR plugin versions prior to 1.9.27 Description: The issue concerns the check privacy settings AJAX action in the WordPress GDPR plugin, which is accessible to both unauthenticated and authenticated users. This action responds with...

WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports personal blog sites on servers running PHP and MySQL. A cross-site scripting vulnerability exists in the Cookies legislation & GDPR plugin for WordPress, which...

WordPress 跨站请求伪造漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports personal blog sites on servers running PHP and MySQL. A security vulnerability exists in the Cookies legislation & GDPR plugin for WordPress, which stems from the...

CVE-2020-20628

controller/controller-comments.php in WP GDPR plugin through 2.1.1 has unauthenticated stored XSS...

CVE-2020-20628

controller/controller-comments.php in WP GDPR plugin through 2.1.1 has unauthenticated stored XSS...

Cross site scripting

controller/controller-comments.php in WP GDPR plugin through 2.1.1 has unauthenticated stored XSS...

CVE-2020-20628

The CVE-2020-20628 entry concerns the WP GDPR plugin up to version 2.1.1, where controller/controller-comments.php is vulnerable to unauthenticated stored XSS. This is the concrete issue described in NVD/NVD-derived entries. Impact, as stated, is user-controlled script execution due to stored XSS...