Read the docs

welaunch

Records5All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

welaunch records in CISA KEV

No welaunch vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Wordpress Gdpr 2 records MEDIUM Wordpress Gdpr&ccpa 2 records MEDIUM Wordpress Country Selector 1 record LOW

Records

5 records

TI-2024-10257 CVE-2024-11069 · GHSA-hfp8-32jq-c2x9

WordPress GDPR <= 2.0.2 - Missing Authorization to Unauthenticated Arbitrary User Deletion

Priority MEDIUM 46

The WordPress GDPR plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'WordPress_GDPR_Data_Delete::check_action' function in all versions up to, and including, 2.0.2.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00445 Published 2024-11-19 No fix listed CWE-862
TI-2021-07096 CVE-2021-24814 · GHSA-46pp-qwvm-gq6q

WordPress GDPR & CCPA < 1.9.26 - Authenticated Reflected Cross-Site Scripting

Priority MEDIUM 45

The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.26, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.02085 Published 2022-02-01 No fix listed CWE-79
TI-2024-09619 CVE-2024-10388 · GHSA-gf4p-rrpw-5r59

WordPress GDPR <= 2.0.2 - Unauthenticated Stored Cross-Site Scripting

Priority LOW 38

The WordPress GDPR plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr_firstname' and 'gdpr_lastname' parameters in all versions up to, and including, 2.0.2 due to insufficient input sanitizat…

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00321 Published 2024-11-19 No fix listed CWE-79
TI-2022-00157 CVE-2022-0220 · GHSA-7c99-6mgq-969f

WordPress GDPR & CCPA < 1.9.27 - Unauthenticated Reflected Cross-Site Scripting

Priority LOW 32

The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.27, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0232 Published 2022-02-01 Fixed in 1.9.27 CWE-116
Open these records in search →