CVE-2024-10388

Summary

CVE-2024-10388 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the WordPress GDPR plugin. Versions up to and including 2.0.2 are impacted. This issue arises due to insufficient input sanitization and output escaping on the 'gdpr_firstname' and 'gdpr_lastname' parameters. As a result, unauthenticated attackers can inject arbitrary web scripts that execute whenever a user accesses an injected page. This poses a significant security risk as the scripts can steal sensitive user data or take control of the affected website. It is recommended that users update to the latest version of the plugin to mitigate this threat.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.