WordPress Plugin Vulnerabilities

WP DSGVO Tools (GDPR) < 3.1.24 - Unauthenticated Plugin's Settings Update to Stored Cross-Site Scripting

Description

The plugin is lacking proper authorisation and CSRF checks, makes some functions available to unauthenticated as well as any authenticated users via AJAX hooks. As a result, unauthenticated users could update some of the plugin's settings, and set a Cross-Site Scripting payload in the Matomo Code one, which will be triggered in all frontend pages.

Proof of Concept

Affects Plugins

Plugin icon
shapepress-dsgvo
Fixed in 3.1.24

References

CVE
CVE-2021-4358
URL
https://wordpress.org/support/topic/weiterleitung-redirects/
URL
https://blog.nintechnet.com/wordpress-wp-dsgvo-tools-gdpr-plugin-patched-vulnerability-actively-exploited/

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.2 (high)

Miscellaneous

Submitter
Pascal Christen
Submitter website
https://pascalchristen.ch
Submitter twitter
the_pesc
Verified
Yes
WPVDB ID
8c181304-42a1-464d-b59d-b46daad3f096

Timeline

Publicly Published
2021-09-24 (about 4 years ago)
Added
2021-09-27 (about 4 years ago)
Last Updated
2023-06-08 (about 2 years ago)

Other

Published
Title
Published
2024-03-21
Title
Page Builder: Pagelayer – Drag and Drop website builder < 1.8.5 - Contributor+ Stored XSS
Published
2023-10-29
Title
Bellows Accordion Menu < 1.4.3 - Contributor+ Stored Cross-Site Scripting
Published
2025-11-03
Title
TablePress < 3.2.5 - Contributor+ Stored XSS
Published
2021-08-16
Title
CBX Bookmark & Favorite < 1.6.9 - Reflected Cross-Site Scripting
Published
2024-08-23
Title
My Sticky Bar < 2.7.3 - Admin+ Stored XSS