DSGVO All in one for WP < 4.0 - Unauthenticated Stored Cross-Site Scripting (XSS)
Priority LOW 30CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
The dsgvoaio_write_log AJAX action of the DSGVO All in one for WP WordPress plugin before 4.0 did not sanitise or escape some POST parameter submitted before outputting them in the Log page in the administrator dashboard (wp-admin/admin.php?page=dsgvoaiofree-show-log). This could allow unauthenticated attackers to gain unauthorised access by using an XSS payload to create a rogue administrator account, which will be trigged when an administrator will view the logs.
Why it matters now
EPSS 0.01186 68th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed DSGVO All in one for WP (Michael Leithold): 4.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Michael Leithold | DSGVO All in one for WP | 4.0 to before 4.0 | 4.0 | Patch available | CNA |
- DSGVO All in one for WP VendorMichael Leithold Affected 4.0 to before 4.0 Fixed in 4.0 Patch available CNA
Remediation
- Fix · CNA DSGVO All in one for WP (Michael Leithold) Fixed in 4.0
Timeline
- 2026-10-02 Threatist record created from CVE-2021-24294
- 2026-10-03 Alias added: GHSA-7mr4-xp7p-pcmc
References
Sources
- CVE-2021-24294 · CVE Program
- CVE-2021-24294 · NVD
- FIRST EPSS
- GHSA-7mr4-xp7p-pcmc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences