Threats tagged 'ghsa-p2v7-9w2f-7fc4'

The DSGVO All in one for WP WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 5.0. This vulnerability arises from insufficient input sanitization and output escaping in the handling of comment content, specifically when the 'Google Tag Manager' integration and the 'Replace integration automatically [Beta]' option are both enabled. Exploitation requires an attacker to submit a crafted comment that must be approved by an administrator, allowing arbitrary script injection that executes when users access the affected pages.