CVE-2023-46071: Unauthenticated XSS in RGPD Plugin

CVE-2023-46071 is an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability in the ClickDatos Protección de Datos RGPD plugin version 3.1.0 and earlier. An attacker can inject malicious JavaScript code through unsanitized parameters, which is then executed in the browser of users visiting the compromised page. The impact affects administrators and site visitors, exposing them to session hijacking, credential theft, and personal data exfiltration.

The CVSS score is 7.1, rated as high severity. The vulnerability was published on NVD on 25 October 2023. Although a discovery from three years ago, it remains relevant: a community-maintained fork on GitHub (updated 5 November 2026) documents the fix, indicating that the community continues to regard it as important. No active exploit signals have been reported on public platforms, but unauthenticated XSS is easily exploitable.

Administrators must immediately verify whether the plugin is installed on their WordPress or equivalent sites. If present in version 3.1.0 or earlier, update to a corrected version or consider using the GitHub community fork. Simultaneously, implement a restrictive Content Security Policy (CSP) to limit execution of injected scripts. Monitor access logs for signs of exploitation (e.g. suspicious query parameters, anomalous session hijacking attempts) and verify the integrity of administrative accounts.