Vulnerabilities

TI-2026-82279 CVE-2026-96741 · GHSA-p2v7-9w2f-7fc4

Stored cross-site scripting in DSGVO All in one for WP via comments

LOW 31

The DSGVO All in one for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output Buffer Regex Corruption in all versions up to, and including, 5.0 due to insufficient input san…

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00236 Published 2026-10-29 No fix listed CWE-79

TI-2026-56430 CVE-2026-81794 · GHSA-2xwm-9r7v-cv99

WordPress Shirt Product Designer for WooCommerce plugin 1.0.4 - Broken Access Control vulnerability

LOW 39

Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce 1.0.4 versions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00346 Published 2026-09-10 No fix listed CWE-862

TI-2026-03741 CVE-2026-4298 · GHSA-6h4r-gjpv-q3jc

DSGVO All in one for WP <= 4.9 - Missing Authorization to Authenticated (Subscriber+) Settings Reset

LOW 20

The DSGVO All in one for WP plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 4.9.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00354 Published 2026-07-09 No fix listed CWE-862

TI-2026-03046 CVE-2026-3535 · GHSA-x9xw-x29g-m332

DSGVO Google Web Fonts GDPR <= 1.1 - Unauthenticated Arbitrary File Upload via 'fonturl' Parameter

MEDIUM 51

The DSGVO Google Web Fonts GDPR plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the `DSGVOGWPdownloadGoogleFonts()` function in all versions up to, and including, 1.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00936 Published 2026-04-08 No fix listed CWE-434

TI-2024-12398 CVE-2024-13356 · GHSA-prmf-fv66-qg6f

DSGVO All in one for WP <= 4.6 - Cross-Site Request Forgery to Account Deletion

LOW 28

The DSGVO All in one for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00233 Published 2025-02-04 No fix listed CWE-352

TI-2021-06586 CVE-2021-24294 · GHSA-7mr4-xp7p-pcmc

DSGVO All in one for WP < 4.0 - Unauthenticated Stored Cross-Site Scripting (XSS)

LOW 30

The dsgvoaio_write_log AJAX action of the DSGVO All in one for WP WordPress plugin before 4.0 did not sanitise or escape some POST parameter submitted before outputting them in the Log page in the administrator dashboard…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01186 Published 2021-05-24 Fixed in 4.0 CWE-79