CVE

CVE-2022-0220

6.1

CVSS

Description

The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.27, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web browser led to this endpoint. Javascript code may be executed on a victim's browser. Due to v1.9.26 adding a CSRF check, the XSS is only exploitable against unauthenticated users (as they all share the same nonce)

Attack Vector

Privileges Req.

User Interaction

wordpress gdpr

Updated Sep 26, 2026View on NVD →

S4E scanner

mediumProduct Based Web Vulnerabilities~10 seconds

CVE-2022-0220 Scanner

CVE-2022-0220 scanner - Cross-Site Scripting (XSS) vulnerability in WordPress GDPR plugin for WordPress

Used 2.1k times · 3.3k assets checked · domain, ipv4, subdomain

Scanner page →Run scanner

CVE history: wordpress gdpr

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →