blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2021-24294

MEDIUM 6.1 CVSS 3.1
Published
May 24, 2021
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-79
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

The dsgvoaio_write_log AJAX action of the DSGVO All in one for WP WordPress plugin before 4.0 did not sanitise or escape some POST parameter submitted before outputting them in the Log page in the administrator dashboard (wp-admin/admin.php?page=dsgvoaiofree-show-log). This could allow unauthenticated attackers to gain unauthorised access by using an XSS payload to create a rogue administrator account, which will be trigged when an administrator will view the logs.

Affected WordPress components

  • DSGVO All in one for WP Plugin · dsgvo-all-in-one-for-wp
    Confirmed match Active
    From 4.0 (including) to 4.0 (excluding)
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Michael Leithold DSGVO All in one for WP — From 4.0 (including) to 4.0 (excluding)
  • mlfactory dsgvo_all_in_one_for_wp — Before 4.0

References

  • wpscan.com https://wpscan.com/vulnerability/43b8cfb4-f875-432b-8e3b-52653fdee87c Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record