DSGVO All in one for WP: Stored Cross-Site Scripting (CVE-2026-96741)

The DSGVO All in one for WP plugin for WordPress (versions 5.0 and earlier) contains a stored cross-site scripting (XSS) vulnerability. The flaw arises from insufficient input sanitization and output escaping when processing comment content. Exploitation is contingent upon an administrator enabling the 'Google Tag Manager' integration and the 'Replace integration automatically [Beta]' setting. Furthermore, the malicious payload must be submitted via a comment and subsequently approved by a site administrator. Successful exploitation allows for the execution of arbitrary scripts within the context of a user's browser when they access the affected page.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary web scripts in the browser of any user viewing the page containing the injected comment. This could lead to session hijacking, unauthorized actions performed on behalf of the user, or further client-side exploitation.

Recommendation

• Update the 'DSGVO All in one for WP' plugin to a version addressing the vulnerability (when released).
• As a temporary mitigation, disable the 'Google Tag Manager' integration and the 'Replace integration automatically [Beta]' option within the plugin settings to remove the exploitation vector.
• Implement strict comment moderation policies to prevent unapproved or suspicious content from being rendered on the site.