CVE-2021-24814 WordPress GDPR & CCPA < 1.9.26 - Authenticated Reflected Cross-Site Scripting
Authenticated reflected XSS in WordPress GDPR plugin allows attackers to execute scripts and potentially take over admin accounts via malicious JSON responses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-24814?
CVE-2021-24814 is a critical cross-site scripting vulnerability in n/a, published on 1 Feb 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.26, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web browser led to this endpoint. Javascript code may be executed on a victim's browser. If the victim is an administrator with a valid session cookie, full control of the WordPress instance may be taken (AJAX calls and iframe manipulation are possible because the vulnerable endpoint is on the same domain as the admin panel - there is no same-origin restriction).
Weakness: CWE-79
Which versions are affected by CVE-2021-24814?
It affects 1 product.
Products include Welaunch Wordpress Gdpr\&ccpa.
How do I fix CVE-2021-24814?
No fix has been published for CVE-2021-24814 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-24814 being exploited?
There is no known exploitation of CVE-2021-24814 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-46pp-qwvm-gq6q.