WordPress The GDPR Framework plugin < 2.4.0 - Unauthenticated Consent Record Forgery and Do Not Sell Requests Spam vulnerability

Unauthenticated Consent Record Forgery and Do Not Sell Requests Spam vulnerability discovered by Pedro Pinho in WordPress Plugin GDPR Framework By Data443 versions 2.4.0...

CVE-2026-14816 The GDPR Framework < 2.4.0 - Unauthenticated Consent Record Forgery and Do Not Sell Requests Spam

The GDPR Framework By Data443 WordPress plugin before 2.4.0 does not properly verify authorization or the identity of the data subject when recording cookie-consent choices and privacy requests, allowing unauthenticated attackers to forge consent records for arbitrary email addresses and to flood...

CVE-2026-14816

The GDPR Framework By Data443 WordPress plugin (versions before 2.4.0 ) is vulnerable to an improper access control flaw. The plugin fails to adequately verify the authorization or the identity of the data subject when recording privacy requests or cookie-consent choices. This allows unauthentica...

CVE-2026-14816: Improper Access Control

The GDPR Framework By Data443 WordPress plugin before 2.4.0 does not properly verify authorization or the identity of the data subject when recording cookie-consent choices and privacy requests, allowing unauthenticated attackers to forge consent records for arbitrary email addresses and to flood...

CVE-2024-13621

The GDPR Framework By Data443 WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13621 The GDPR Framework By Data443 < 2.2.0 - Admin+ Stored XSS

The GDPR Framework By Data443 WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13621

The GDPR Framework By Data443 WordPress plugin, in versions prior to 2.2.0 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the lack of proper sanitization and escaping of certain plugin settings. This flaw allows high-privilege users, such as administrators, to perform St...

CVE-2024-13621 The GDPR Framework By Data443 < 2.2.0 - Admin+ Stored XSS

The GDPR Framework By Data443 WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13621: Improper Neutralization of Input During Web Page Generation

The GDPR Framework By Data443 WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

PT-2025-21461 · WordPress · The Gdpr Framework By Data443

Name of the Vulnerable Software and Affected Versions: The GDPR Framework By Data443 WordPress plugin versions prior to 2.2.0 Description: The issue concerns the lack of sanitization and escaping of certain settings in the plugin, which could allow high-privilege users, such as admins, to perform...