CVE-2026-96741 in DSGVO All in one for WP Plugin
Summary
by MITRE • 10/29/2026
The DSGVO All in one for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output Buffer Regex Corruption in all versions up to, and including, 5.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when the administrator has enabled both the 'Google Tag Manager' integration and the 'Replace integration automatically [Beta]' option, and requires the crafted comment to be approved by an administrator.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The DSGVO All in one for WP plugin for WordPress contains a critical stored cross-site scripting vulnerability that stems from insufficient input sanitization and output escaping mechanisms within its core functionality. This flaw specifically affects versions up to and including 5.0, allowing unauthenticated attackers to inject arbitrary web scripts into pages through the comment content field. The technical root cause of this issue is identified as an output buffer regex corruption, which occurs when the plugin processes user-supplied data without adequately validating or encoding special characters that could be interpreted as executable code by a web browser. This lack of proper handling creates a pathway for malicious script injection that persists in the database until manually removed, classifying it as a stored vulnerability rather than a reflected one.
The operational impact of this vulnerability is significant because it enables persistent attacks against site visitors and administrators alike. When an attacker successfully injects malicious scripts via comments, these scripts execute automatically whenever any user accesses the page containing the compromised content. This can lead to severe security consequences including session hijacking, credential theft, defacement of the website, or redirection to phishing sites. The persistence of the injected code means that multiple users may be affected over time without immediate detection by site administrators who might not regularly inspect comment sections for malicious payloads.
Exploitation of this vulnerability is conditional upon specific configuration settings within the WordPress environment. It requires the administrator to have enabled both the Google Tag Manager integration and the Replace integration automatically Beta option. These features likely interact with the comment processing pipeline in a way that bypasses standard security checks or introduces parsing errors due to regex corruption. Furthermore, the attack vector necessitates that the crafted malicious comment be approved by an administrator before it becomes visible to other users. This requirement adds a social engineering component to the exploitation process, as attackers must deceive administrators into approving comments containing their payloads.
From a classification perspective, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting XSS and specifically falls under Stored XSS where malicious scripts are permanently stored within target applications such as databases or comment systems. In terms of the MITRE ATT&CK framework, this behavior corresponds to T1059 Command and Scripting Interpreter for executing injected code and potentially T1189 Drive-by Compromise if used to deliver malware payloads through browser exploits triggered by the executed scripts. The regex corruption aspect also hints at potential CWE-730 Injection of Incorrect Regular Expression Pattern which can lead to denial of service or unexpected behavior in parsing logic that attackers leverage for script injection.
Mitigation strategies should focus on immediate remediation and long-term security hardening. Administrators running affected versions must upgrade the plugin to a patched version where input sanitization and output escaping have been rigorously implemented according to OWASP guidelines. Until an update is available, disabling the Google Tag Manager integration and the Replace integration automatically Beta option can reduce the attack surface by preventing the specific code paths that lead to regex corruption. Additionally implementing strict content security policies CSP headers can help mitigate the impact of any successfully injected scripts by restricting where scripts are allowed to load from. Regular audits of comment sections for suspicious activity combined with user education on recognizing phishing attempts further strengthen defenses against this type of social engineering assisted exploitation.