wp-gdpr-compliance 漏洞

中危CVE-2022-01472022/03/14

WordPress Cookie Information/Free GDPR Consent Solution <2.0.8 - Cross-Site Scripting

WordPress Cookie Information/Free GDPR Consent Solution plugin prior to 2.0.8 contains a cross-site scripting vulnerability via the admin dashboard. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

wp-gdpr-compliancePoC 已收录

CVSS6.1EPSS 1.3%

严重CVE-2018-192072018/11/12

WP GDPR Compliance < 1.4.3 - Unauthenticated Call Any Action or Update Any Option

The Van Ons WP GDPR Compliance (aka wp-gdpr-compliance) plugin before 1.4.3 for WordPress allows remote attackers to execute arbitrary code because $wpdb->prepare() input is mishandled, as exploited in the wild in November 2018.

wp-gdpr-compliancePoC 已收录RCE

CVSS9.8EPSS 89.2%

wp-gdpr-compliance

关联漏洞

WordPress Cookie Information/Free GDPR Consent Solution <2.0.8 - Cross-Site Scripting

WP GDPR Compliance < 1.4.3 - Unauthenticated Call Any Action or Update Any Option