CVE-2026-96741

HighCVSS 7.2

Published: 29/10/2026(UTC)Updated: 29/10/2026(UTC)Translated: 29/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

15th percentile - higher than 15% of all known CVEs

Summary

The DSGVO All in one for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content through Output Buffer Regex Corruption in all versions up to and including 5.0 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages.

Risk Assessment

Malicious scripts will execute in the browsers of users visiting the affected page, potentially leading to session or data theft. Exploitation requires the Google Tag Manager integration and automatic replacement option to be enabled and the crafted comment to be approved by an administrator.

Recommendation

Update the plugin to a version newer than 5.0 if available, or disable the Google Tag Manager integration and automatic replacement option. Review comments before approving them.

Other vulnerabilities in DSGVO All in one for WP

CVE-2026-4298Medium
The DSGVO All in one for WP plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 4.9. The dsgvo_reset_policy_service_func() function lacks both capability checks and nonce verification while processing user-supplied parameters to reset plugin options. This allows authenticated attackers with Subscriber-level access and above to reset all customized privacy policy content including cookie notices, Google Analytics policies, Facebook policies, and YouTube policies to their default values.

Original NVD description (English source)

The DSGVO All in one for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output Buffer Regex Corruption in all versions up to, and including, 5.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when the administrator has enabled both the 'Google Tag Manager' integration and the 'Replace integration automatically [Beta]' option, and requires the crafted comment to be approved by an administrator.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS