WordPress Plugin Vulnerabilities

WP GDPR <= 2.1.1 - Multiple Unauthenticated Issues

Description

The plugin is affected by multiple issues, and has been closed from WP repo:
- Unauthenticated Stored XSS
- Unauthenticated Content spoofing
- Unauthenticated Arbitrary comment deletion
- Unauthenticated plugin's settings update

Affects Plugins

Plugin icon
wp-gdpr-core
No known fix

References

CVE
CVE-2020-36697
URL
https://blog.nintechnet.com/unauthenticated-stored-xss-and-content-spoofing-vulnerabilities-in-wordpress-wp-gdpr-plugin-unpatched/

Miscellaneous

Original Researcher
Jerome Bruandet (nintechnet.com)
Verified
No
WPVDB ID
81d3abf5-cf0a-4866-a518-e8853da1b8e0

Timeline

Publicly Published
2020-04-23 (about 6 years ago)
Added
2020-04-23 (about 6 years ago)
Last Updated
2023-06-08 (about 2 years ago)

Other

Published
Title
Published
2019-09-08
Title
Nexos - Real Estate < 1.6.1 - SQL Injection & Persistent XSS
Published
2014-08-01
Title
Multiple vulnerabilities in Chocolate WP theme for WordPress
Published
2019-07-11
Title
School Management < 57.0 - CSRF and Stored XSS
Published
2019-06-24
Title
Custom CSS Pro <= 1.0.3 - CSRF & XSS
Published
2019-06-19
Title
Shortlinks by Pretty Links <= 2.1.9 - Stored XSS and CSV Injection