WordPress ProfilePress plugin <= 4.15.5 - Authenticated Stored Cross-Site Scripting vulnerability

🗓️ 11 Apr 2024 12:50:13Reported by stealthcopterType

Authenticated stored XSS in WordPress ProfilePress plugin up to version 4.15.5 found by stealthcopter.

Reporter	Title	Published	Views	Family All 12
CNNVD	WordPress Plugin ProfilePress 安全漏洞	10 Apr 202400:00	–	cnnvd
CVE	CVE-2024-3210	10 Apr 202405:32	–	cve
Cvelist	CVE-2024-3210 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'reg-single-checkbox'	10 Apr 202405:32	–	cvelist
EUVD	EUVD-2024-31802	3 Oct 202520:07	–	euvd
NVD	CVE-2024-3210	10 Apr 202406:15	–	nvd
OpenVAS	WordPress ProfilePress Plugin < 4.15.6 XSS Vulnerability	5 Feb 202500:00	–	openvas
OSV	CVE-2024-3210	10 Apr 202406:15	–	osv
Patchstack	WordPress ProfilePress Plugin <= 4.15.5 is vulnerable to Cross Site Scripting (XSS)	11 Apr 202400:00	–	patchstack
RedhatCVE	CVE-2024-3210	23 May 202509:22	–	redhatcve
Vulnrichment	CVE-2024-3210 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'reg-single-checkbox'	10 Apr 202405:32	–	vulnrichment

Vulners

Node

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-user-avatar/paid-membership-plugin-ecommerce-user-registration-form-login-form-user-profile-restrict-content-profilepress-4155-authenticated-contributor-stored-cross-site-scriptin

11 Apr 2024 12:50Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.15.4 - 6.4

EPSS0.00519

SSVC