CVE-2022-0220

CVE-2022-0220 corresponds to a cross-site scripting flaw in the WordPress GDPR & CCPA plugin prior to version 1.9.27. The check_privacy_settings AJAX action, accessible to both unauthenticated and authenticated users, returns JSON data without the proper application/json content-type. The unescap...

CVE-2021-24814

The CVE-2021-24814 entry concerns the WordPress GDPR & CCPA plugin (before 1.9.26). The check_privacy_settings AJAX action responds with JSON data without an application/json content-type, allowing HTML payloads to be interpreted by the victim’s browser. This enables JavaScript execution in the b...