1353 matches found
EUVD-2026-75135
Missing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 mageplaza/module-gdpr through 4.2.9 allows remote unauthenticated attackers to delete any customer's saved address, and to erase all stored addresses by iterating the address id, via a GET request to...
PT-2026-89134
Missing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 mageplaza/module-gdpr through 4.2.9 allows remote unauthenticated attackers to delete any customer's saved address, and to erase all stored addresses by iterating the address id, via a GET request to...
CVE-2026-79324
Missing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 mageplaza/module-gdpr through 4.2.9 allows remote unauthenticated attackers to delete any customer's saved address, and to erase all stored addresses by iterating the address id, via a GET request to...
CVE-2026-79324
The mageplaza/module-gdpr extension for Magento 2 (versions through 4.2.9 ) is vulnerable to an authorization bypass in the Address Delete controller . Because the controller extends the legacy Action class instead of AbstractAccount , it fails to enforce authentication , ownership , or form key ...
CVE-2026-79324: Authorization Bypass Through User-Controlled Key
Missing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 mageplaza/module-gdpr through 4.2.9 allows remote unauthenticated attackers to delete any customer's saved address, and to erase all stored addresses by iterating the address id, via a GET request to...
CVE-2026-14989: Improper Neutralization of Input During Web Page Generation
The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpluserpreference' parameter in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping. This makes it possible for...
Exploit for CVE-2026-75865
CVE-2026-75865 Proof-of-concept and technical write-up for...
CVE-2026-77263: Improper Neutralization of Input During Web Page Generation
The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.13.4 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-77233: Improper Neutralization of Input During Web Page Generation
The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite in all versions up to, and including, 3.13.4 due to insufficient input sanitization and output escaping. This...
CVE-2026-75865: Unrestricted Upload of File with Dangerous Type
The WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the saasuploadlogo function combined with an authorization bypass on the WPLP connector REST endpoin...
CVE-2026-82970
Unrestricted Upload of File with Dangerous Type vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent allows Using Malicious Files. This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through 4.4.1...
CVE-2026-82970
CVE-2026-82970 is an Unrestricted File Upload vulnerability in the WordPress plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent (by WP Legal Pages), affecting versions through 4.4.1 . Discovered by Jiemook , the flaw allows an unauthenticated attacker to upload a malicious file over the ne...
CVE-2026-82970: Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent allows Using Malicious Files. This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through 4.4.1...
PT-2026-83851
Name of the Vulnerable Software and Affected Versions WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions prior to 4.4.2 Description An unauthenticated file upload flaw allows the unrestricted upload of files with dangerous types, which could enable the use of malicious files on the syste...
CVE-2026-16984: Improper Access Control
The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not include an authorization check on a REST route that returns stored account data, allowing unauthenticated visitors to retrieve the connected service's API secr...
WordPress The GDPR Framework plugin < 2.4.0 - Unauthenticated Consent Record Forgery and Do Not Sell Requests Spam vulnerability
Unauthenticated Consent Record Forgery and Do Not Sell Requests Spam vulnerability discovered by Pedro Pinho in WordPress Plugin GDPR Framework By Data443 versions 2.4.0...
Twitch wants your content for Amazon AI training. Here’s how to opt out
The Dutch Autoriteit Persoonsgegevens AP has advised Twitch users to opt out of sharing data with Amazon AI. Twitch launched as a live-video platform and is currently owned by Amazon. Its core product is live broadcasting with a built-in chat culture: streamers broadcast gameplay, commentary,...
pii-shield v2.2.0
PII-Shield 🛡️ Zero-code log sanitization sidecar for Kubernetes. Prevents data leaks GDPR/SOC2 by redacting PII from logs before they leave the pod. PII-Shield runs in-process — CLI, sidecar, or WASM. There is no hosted API and no server your data is sent to. "Don't let PII poison your AI models."...
