CVE-2021-24294: 
WordPress vulnerability analysis and mitigation

The DSGVO All in one for WP WordPress plugin before version 4.0 contained a vulnerability identified as CVE-2021-24294. This security flaw was discovered and reported on May 7, 2021, affecting the plugin's log functionality through the dsgvoaiowritelog AJAX action (WPScan).

The vulnerability is classified as an Unauthenticated Stored Cross-Site Scripting (XSS) with a CVSS score of 8.3 (high). The issue stems from the dsgvoaiowritelog AJAX action failing to properly sanitize or escape POST parameters before outputting them in the Log page of the administrator dashboard at wp-admin/admin.php?page=dsgvoaiofree-show-log (WPScan).

This vulnerability could allow unauthenticated attackers to inject malicious JavaScript code that would execute when an administrator views the logs. The potential impact includes the ability to create unauthorized administrator accounts, potentially leading to complete site compromise (WPScan).

The vulnerability was patched in version 4.0 of the DSGVO All in one for WP plugin. Users should update to this version or later to protect against this security issue (WPScan).