CVE-2026-96741: DSGVO All in one for WP <= 5.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Output Buffer Regex Corruption
The DSGVO All in one for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output Buffer Regex Corruption in all versions up to, and including, 5.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when the administrator has enabled both the 'Google Tag Manager' integration and the 'Replace integration automatically [Beta]' option, and requires the crafted comment to be approved by an administrator.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to exploitation?
Deployments using DSGVO All in one for WP version 5.0 or earlier are exposed only if both the Google Tag Manager integration and the “Replace integration automatically [Beta]” option are enabled.
What must an attacker do to exploit this issue?
An unauthenticated attacker must submit a crafted comment containing script content. An administrator must then approve that comment before the injected script can execute when someone visits the affected page.
What can be done if updating is not immediately possible?
Disable either the Google Tag Manager integration or the “Replace integration automatically [Beta]” option, since exploitation requires both settings. Review and avoid approving suspicious comments, as approval is also required for exploitation.
How can administrators determine whether malicious content may already be present?
Review approved comments for crafted or suspicious script content, particularly on sites where both required integration settings were enabled. Pages containing approved malicious comments may execute the injected script when visited.