PatchTheCVECVE-2021-24294: The dsgvoaio_write_log AJAX action of the DSGVO All in one for WP WordPress plugin before 4.0 did not sanitise
CVE-2021-24294 is a medium-severity flaw (CVSS 6.1) affecting dsgvo all in one for wp. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The dsgvoaio_write_log AJAX action of the DSGVO All in one for WP WordPress plugin before 4.0 did not sanitise or escape some POST parameter submitted before outputting them in the Log page in the administrator dashboard (wp-admin/admin.php?page=dsgvoaiofree-show-log). This could allow unauthenticated attackers to gain unauthorised access by using an XSS payload to create a rogue administrator account, which will be trigged when an administrator
Why this priority
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.1 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 1.2% (top 32%) |
| CISA exploited list | No |
| Weakness | CWE-79 |
| Published | 2021-05-24 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2021-24294?
dsgvo all in one for wp: upgrade to 4.0. Exact commands for each OS are on this page.
Is CVE-2021-24294 being exploited?
CVE-2021-24294 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2021-24294 affect?
CVE-2021-24294 affects dsgvo all in one for wp. Severity is medium (CVSS 6.1). The dsgvoaio_write_log AJAX action of the DSGVO All in one for WP WordPress plugin before 4.0 did not sanitise or escape some POST parameter submitted before outputting them in the Log page in the administrator dashboard (wp-admin/admin.php
How urgent is CVE-2021-24294?
Priority 43/100. Public exploit reference
Software pages
WordPress vulnerabilities · PHP vulnerabilities
Related CVEs
- CVE-2024-43964 MEDIUM 6.5 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in M
- CVE-2024-27967 MEDIUM 4.3 UPGRADE Cross-Site Request Forgery (CSRF) vulnerability in Michael Leithold DSGVO All in one for WP.This issue affects