Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Vendor: welaunch Clear all filters
TI-2024-09619 CVE-2024-10388 · GHSA-gf4p-rrpw-5r59

WordPress GDPR <= 2.0.2 - Unauthenticated Stored Cross-Site Scripting

Priority LOW 38

The WordPress GDPR plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr_firstname' and 'gdpr_lastname' parameters in all versions up to, and including, 2.0.2 due to insufficient input sanitizat…

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00321 Published 2024-11-19 No fix listed CWE-79
TI-2024-10257 CVE-2024-11069 · GHSA-hfp8-32jq-c2x9

WordPress GDPR <= 2.0.2 - Missing Authorization to Unauthenticated Arbitrary User Deletion

Priority MEDIUM 46

The WordPress GDPR plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'WordPress_GDPR_Data_Delete::check_action' function in all versions up to, and including, 2.0.2.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00445 Published 2024-11-19 No fix listed CWE-862
TI-2022-00157 CVE-2022-0220 · GHSA-7c99-6mgq-969f

WordPress GDPR & CCPA < 1.9.27 - Unauthenticated Reflected Cross-Site Scripting

Priority LOW 32

The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.27, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0232 Published 2022-02-01 Fixed in 1.9.27 CWE-116
TI-2021-07096 CVE-2021-24814 · GHSA-46pp-qwvm-gq6q

WordPress GDPR & CCPA < 1.9.26 - Authenticated Reflected Cross-Site Scripting

Priority MEDIUM 45

The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.26, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.02085 Published 2022-02-01 No fix listed CWE-79