CVE-2021-24294CWE-79

CVE-2021-24294: fallo en Michael Leithold DSGVO All in one for WP

DSGVO All in one for WP < 4.0 - Unauthenticated Stored Cross-Site Scripting (XSS)

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear DSGVO All in one for WP

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

3Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackepss 1.2%
The dsgvoaio_write_log AJAX action of the DSGVO All in one for WP WordPress plugin before 4.0 did not sanitise or escape some POST parameter submitted before outputting them in the Log page in the administrator dashboard (wp-admin/admin.php?page=dsgvoaiofree-show-log). This could allow unauthenticated attackers to gain unauthorised access by using an XSS payload to create a rogue administrator account, which will be trigged when an administrator will view the logs.
Productos afectados
Michael Leithold · DSGVO All in one for WP
CVEs relacionadas — Michael Leithold DSGVO All in one for WP

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-43964MEDIUMWordPress DSGVO All in one for WP plugin <= 4.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-27967MEDIUMWordPress DSGVO All in one for WP plugin <= 4.3 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.2%