Vulnerability · Published Feb 1, 2022 · Assigned by WPScan

CVE-2022-0220WordPress GDPR & CCPA < 1.9.27 - Unauthenticated Reflected Cross-Site Scripting

Medium 6.1

In plain English

A medium-severity security flaw in WordPress GDPR from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 84% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS NVD)6.1Medium

Exploit odds (30 days)2.3%top 16.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Nuclei

Official description

The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.27, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web browser led to this endpoint. Javascript code may be executed on a victim's browser. Due to v1.9.26 adding a CSRF check, the XSS is only exploitable against unauthenticated users (as they all share the same nonce)

Affected products (as reported)

Vendor	Product	Versions
Unknown	WordPress GDPR	0 – before 1.9.27

References

https://wpscan.com/vulnerability/a91a01b9-7e36-4280-bc50-f6cff3e66059 exploit, vdb-entry, technical-description