CVE-2022-2628

What it actually does

The plugin fails to sanitize and escape certain settings fields, permitting stored XSS payloads to persist and execute in other users' browsers even when unfiltered_html is disabled.

Why it matters to the business

Compromised WordPress sites risk unauthorized script execution that can lead to admin session hijacking, defacement, or theft of visitor data, increasing operational and compliance exposure for organizations relying on the plugin.

How an attack unfolds

An attacker with high-privilege access, such as an administrator in a multisite setup, stores a malicious script in an unsanitized plugin setting; the payload is later executed when other privileged users load the affected settings page or related admin screens.

How to fix it

Upgrade the DSGVO All in one for WP plugin to version 4.2 or later to enforce proper sanitization and output escaping on all settings.

How to confirm the fix worked

Confirm the installed plugin version is 4.2 or newer; attempt to persist script tags or event handlers in settings fields and verify they are stripped or escaped on output.

Typical attack path

1. Gain high-privilege WordPress administrator access in a multisite environment
2. Access the DSGVO All in one for WP plugin settings
3. Insert a stored XSS payload into an unsanitized configuration field
4. Save the setting so the payload persists in the database
5. Trigger execution by having other users view the affected admin interface

How to detect it

Review WordPress admin activity logs and plugin option changes for unexpected updates; inspect database-stored plugin settings for script or HTML tags; monitor web request logs for admin-page responses containing executable script content.

What your security team should do

• Upgrade the plugin to version 4.2 or later immediately
• Scan existing plugin option values for injected scripts and remove any suspicious content
• Enable additional input validation or WAF rules targeting XSS patterns in admin areas
• Review and restrict administrative capabilities in multisite configurations