WordPress GDPR & CCPA <1.9.27 - Cross-Site Scripting
WordPress GDPR & CCPA plugin before 1.9.27 contains a cross-site scripting vulnerability. The check_privacy_settings AJAX action, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type, and JavaScript code may be executed on a victim's browser.
PoC 已收录wordpress_gdpr
CVSS6.1EPSS 2.3%