WordPress GDPR

WordPress GDPR has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2024; all 4 are fixed as of September 2026. Their average CVSS score is 6.6, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high. 2024 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 3 of the records (75%). Other recurring categories include Missing Authorization.

Every one of the 4 issues recorded for WordPress GDPR has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, most of them (2) reported by Ace Candelario.

Strategic Overview

Avg CVSSMedium

6.6/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all WordPress GDPR vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.2CVE-2024-10388

WordPress GDPR <= 2.0.2 - Unauthenticated Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

4 records


2024-11-17 00:00	WordPress GDPR <= 2.0.2 - Missing Authorization to Unauthenticated Arbitrary User Deletion WordPress GDPR <= 2.0.2	`CVE-2024-11069`	6.5 Medium	István Márton	Yes
2024-11-17 00:00	WordPress GDPR <= 2.0.2 - Unauthenticated Stored Cross-Site Scripting WordPress GDPR <= 2.0.2	`CVE-2024-10388`	7.2 High	István Márton	Yes
2022-01-26 00:00	WordPress GDPR & CCPA <= 1.9.26 Reflected Cross-Site Scripting WordPress GDPR < 1.9.27	`CVE-2022-0220`	6.5 Medium	Ace Candelario	Yes
2022-01-26 00:00	WordPress GDPR & CCPA < 1.9.26 - Reflected Cross-Site Scripting WordPress GDPR <= 1.9.26	`CVE-2021-24814`	6.1 Medium	Ace Candelario	Yes

Showing 1–4 of 4 reports