WordPress Cookii – Free GDPR Cookie Consent plugin <= 3.0.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Cookii – Free GDPR Cookie Consent plugin versions = 3.0.2. Solution No patched version available...

WordPress WP-HR GDPR: GDPR Tools for Human Resources on WordPress plugin < 0.9 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress WP-HR GDPR: GDPR Tools for Human Resources on WordPress plugin versions 0.9. Solution Update the WordPress WP-HR GDPR: GDPR Tools for Human Resources on WordPress plugin to the latest available version at least 0.9...

WordPress Surbma | GDPR Proof Cookie Consent & Notice Bar plugin <= 17.5.2 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Surbma | GDPR Proof Cookie Consent & Notice Bar plugin versions = 17.5.2. Solution Update the WordPress Surbma | GDPR Proof Cookie Consent & Notice Bar plugin to the latest available version at least 17.5.3...

WordPress TK Google Fonts GDPR Compliant plugin <= 2.2.0 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress TK Google Fonts GDPR Compliant plugin versions = 2.2.0. Solution Update the WordPress TK Google Fonts GDPR Compliant plugin to the latest available version at least 2.2.1...

WordPress TK Google Fonts GDPR Compliant plugin <= 2.2.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress TK Google Fonts GDPR Compliant plugin versions = 2.2.0. Solution Update the WordPress TK Google Fonts GDPR Compliant plugin to the latest available version at least 2.2.1...

WordPress "WordPress YouTube, Vimeo and more elements security Plugin (GDPR)" plugin <= 1.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress "WordPress YouTube, Vimeo and more elements security Plugin GDPR" plugin versions = 1.2. Solution No patched version available...

WordPress Cookii – Free GDPR Cookie Consent plugin <= 3.0.2 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Cookii – Free GDPR Cookie Consent plugin versions = 3.0.2. Solution No patched version available...

WordPress WP-HR GDPR: GDPR Tools for Human Resources on WordPress plugin < 0.9 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress WP-HR GDPR: GDPR Tools for Human Resources on WordPress plugin versions 0.9. Solution Update the WordPress WP-HR GDPR: GDPR Tools for Human Resources on WordPress plugin to the latest available version...

WordPress Surbma | GDPR Proof Cookie Consent & Notice Bar plugin <= 17.5.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Surbma | GDPR Proof Cookie Consent & Notice Bar plugin versions = 17.5.2. Solution Update the WordPress Surbma | GDPR Proof Cookie Consent & Notice Bar plugin to the latest available version at least...

Cloud Security and Compliance: The Ultimate Frenemies of Financial Services

Meeting compliance standards as a financial services finserv company can be incredibly time-consuming and expensive. Finserv has some of the highest regulatory bars to clear out of any industry — with the exception, perhaps, of healthcare. That said, these regulations exist for good reason. Even...

France Rules That Using Google Analytics Violates GDPR Data Protection Law

French data protection regulators on Thursday found the use of Google Analytics a breach of the European Union's General Data Protection Regulation GDPR laws in the country, almost a month after a similar decision was reached in Austria. To that end, the National Commission on Informatics and...

Evolving How We Share Rapid7 Research Data

In the spring of 2018, we launched the Open Data initiative to provide security teams and researchers with access to research data generated from Project Sonar and Project Heisenberg. Our goal for those projects is to understand how the attack surface is evolving, what exposures are most common o...

CVE-2022-0220

The checkprivacysettings AJAX action of the WordPress GDPR WordPress plugin before 1.9.27, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web...

CVE-2022-0220

The checkprivacysettings AJAX action of the WordPress GDPR WordPress plugin before 1.9.27, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web...

CVE-2022-0220

The checkprivacysettings AJAX action of the WordPress GDPR WordPress plugin before 1.9.27, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web...

CVE-2021-24814

The checkprivacysettings AJAX action of the WordPress GDPR WordPress plugin before 1.9.26, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web...

CVE-2021-24814

The checkprivacysettings AJAX action of the WordPress GDPR WordPress plugin before 1.9.26, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web...

Type confusion

The checkprivacysettings AJAX action of the WordPress GDPR WordPress plugin before 1.9.27, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web...

Type confusion

The checkprivacysettings AJAX action of the WordPress GDPR WordPress plugin before 1.9.26, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web...

CVE-2022-0220

CVE-2022-0220 corresponds to a cross-site scripting flaw in the WordPress GDPR & CCPA plugin prior to version 1.9.27. The check_privacy_settings AJAX action, accessible to both unauthenticated and authenticated users, returns JSON data without the proper application/json content-type. The unescap...