Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability leading to Cross-Site Scripting XSS discovered in tarteaucitron.js – Cookies legislation & GDPR WordPress plugin versions = 1.5.4, vulnerable parameters "tarteaucitronEmail" and "tarteaucitronPass"...

CVE-2021-36887 WordPress tarteaucitron.js – Cookies legislation & GDPR plugin <= 1.5.4 - Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS)

Cross-Site Request Forgery CSRF vulnerability leading to Cross-Site Scripting XSS discovered in tarteaucitron.js – Cookies legislation & GDPR WordPress plugin versions = 1.5.4, vulnerable parameters "tarteaucitronEmail" and "tarteaucitronPass"...

CVE-2021-36887

The CVE-2021-36887 has concrete details in connected sources: the tarteaucitron.js – Cookies legislation & GDPR WordPress plugin (versions

CVE-2021-36887 WordPress tarteaucitron.js – Cookies legislation & GDPR plugin <= 1.5.4 - Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS)

Cross-Site Request Forgery CSRF vulnerability leading to Cross-Site Scripting XSS discovered in tarteaucitron.js – Cookies legislation & GDPR WordPress plugin versions = 1.5.4, vulnerable parameters "tarteaucitronEmail" and "tarteaucitronPass"...

CVE-2021-36889 WordPress tarteaucitron.js – Cookies legislation & GDPR plugin <= 1.6 - Multiple Stored Authenticated Cross-Site Scripting (XSS) vulnerabilities

Multiple Stored Authenticated Cross-Site Scripting XSS vulnerabilities were discovered in tarteaucitron.js – Cookies legislation & GDPR WordPress plugin versions = 1.6...

CVE-2021-36889 WordPress tarteaucitron.js – Cookies legislation & GDPR plugin <= 1.6 - Multiple Stored Authenticated Cross-Site Scripting (XSS) vulnerabilities

Multiple Stored Authenticated Cross-Site Scripting XSS vulnerabilities were discovered in tarteaucitron.js – Cookies legislation & GDPR WordPress plugin versions = 1.6...

WordPress 跨站请求伪造漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports personal blog sites on servers running PHP and MySQL. A security vulnerability exists in the Cookies legislation & GDPR plugin for WordPress, which stems from the...

WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports personal blog sites on servers running PHP and MySQL. A cross-site scripting vulnerability exists in the Cookies legislation & GDPR plugin for WordPress, which...

WordPress tarteaucitron.js – Cookies legislation & GDPR plugin <= 1.6 - Multiple Stored Authenticated Cross-Site Scripting (XSS) vulnerabilities

Multiple Stored Authenticated Cross-Site Scripting XSS vulnerabilities were discovered by Ex.Mi Patchstack Red Team in WordPress tarteaucitron.js – Cookies legislation & GDPR plugin versions = 1.6. Solution Update the WordPress tarteaucitron.js – Cookies legislation & GDPR plugin to the latest...

tarteaucitron.js - Cookies legislation & GDPR < 1.6.1 - Admin + Stored Cross-Site Scripting

The plugin does not sanitise and escape some of its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

WordPress tarteaucitron.js – Cookies legislation & GDPR plugin <= 1.5.4 - Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS)

Cross-Site Request Forgery CSRF vulnerability leading to Cross-Site Scripting XSS discovered by Julio Potier SecuPress.me in WordPress tarteaucitron.js – Cookies legislation & GDPR plugin versions = 1.5.4. Solution Update the WordPress tarteaucitron.js – Cookies legislation & GDPR plugin to the...

WP DSGVO Tools (GDPR) Plugin for WordPress < 3.1.24 Arbitrary Post Deletion

The WordPress WP DSGVO Tools GDPR Plugin installed on the remote host is affected by an unauthenticated arbitrary post deletion vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source data...

CVE-2021-42359

WP DSGVO Tools GDPR = 3.1.23 had an AJAX action, ‘admin-dismiss-unsubscribe‘, which lacked a capability check and a nonce check and was available to unauthenticated users, and did not check the post type when deleting unsubscription requests. As such, it was possible for an attacker to permanentl...

Design/Logic Flaw

WP DSGVO Tools GDPR = 3.1.23 had an AJAX action, ‘admin-dismiss-unsubscribe‘, which lacked a capability check and a nonce check and was available to unauthenticated users, and did not check the post type when deleting unsubscription requests. As such, it was possible for an attacker to permanentl...

CVE-2021-42359

CVE-2021-42359 affects WordPress WP DSGVO Tools (GDPR) plugin versions

CVE-2021-42359 WP DSGVO Tools (GDPR) <= 3.1.23 Unauthenticated Arbitrary Post Deletion

WP DSGVO Tools GDPR = 3.1.23 had an AJAX action, ‘admin-dismiss-unsubscribe‘, which lacked a capability check and a nonce check and was available to unauthenticated users, and did not check the post type when deleting unsubscription requests. As such, it was possible for an attacker to permanentl...

Vulnerability in WP DSGVO Tools (GDPR) Plugin Allows Unauthenticated Page Deletion

Note: To receive disclosures like this in your inbox the moment they’re published, you can subscribe to our WordPress Security Mailing List. On September 27, 2021, the Wordfence Threat Intelligence team initiated the disclosure process for a vulnerability we found in WP DSGVO Tools GDPR, a...

WP DSGVO Tools (GDPR) < 3.1.24 - Unauthenticated Arbitrary Post Deletion

The ‘admin-dismiss-unsubscribe‘ AJAX action in WP DSGVO Tools GDPR = 3.1.23 lacked a capability check and a nonce check and was available to unauthenticated users, and did not check the post type when deleting unsubscription requests. As such, it was possible for an attacker to permanently delete...

WordPress WP DSGVO Tools (GDPR) plugin <= 3.1.22 - Unauthenticated Arbitrary Post Deletion vulnerability

Unauthenticated Arbitrary Post Deletion vulnerability discovered by Ramuel Gall WordFence in WordPress WP DSGVO Tools GDPR plugin versions = 3.1.22. Solution Update the WordPress WP DSGVO Tools GDPR plugin to the latest available version at least 3.1.24...

WordPress Cookie Notice & Compliance for GDPR / CCPA Plugin < 2.1.2 XSS Vulnerability

The WordPress plugin Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...