Lucene search

PatchstackCVE-2024-29097

HistoryMar 19, 2024 - 4:15 p.m.

CVE-2024-29097

2024-03-1916:15:10

CWE-79

Patchstack

web.nvd.nist.gov

cve-2024-29097

cross-site scripting

stored xss

pickplugins

user profile

CVSS3

6.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

AI Score

9.1

Confidence

High

EPSS

Percentile

9.0%

JSON

Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in PickPlugins User profile allows Stored XSS.This issue affects User profile: from n/a through 2.0.20.

Affected configurations

Vulners

Node

pickpluginsuser_verificationRange≤2.0.20wordpress

VendorProductVersionCPE
pickpluginsuser_verification*cpe:2.3:a:pickplugins:user_verification:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
pickplugins	user_verification	*	cpe:2.3:a:pickplugins:user_verification::::::wordpress::*

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "user-profile",
    "product": "User profile",
    "vendor": "PickPlugins",
    "versions": [
      {
        "changes": [
          {
            "at": "2.0.21",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "2.0.20",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/user-profile/wordpress-user-profile-plugin-2-0-20-subscriber-stored-cross-site-scripting-xss-vulnerability?_s_id=cve