WordPress ProfilePress Plugin <= 4.14.4 is vulnerable to Cross Site Scripting (XSS)

🗓️ 20 Feb 2024 00:00:00Reported by Arkadiusz HydzikType

WordPress ProfilePress Plugin <= 4.14.4 Cross Site Scripting (XSS) Vulnerabilit

Reporter	Title	Published	Views	Family All 7
Vulnrichment	CVE-2024-1408	20 Feb 202418:56	–	vulnrichment
Prion	Cross site scripting	29 Feb 202401:43	–	prion
CVE	CVE-2024-1408	29 Feb 202401:43	–	cve
WPVulnDB	ProfilePress < 4.15.0 - Contributor+ Stored XSS	20 Feb 202400:00	–	wpvulndb
Cvelist	CVE-2024-1408	20 Feb 202418:56	–	cvelist
NVD	CVE-2024-1408	29 Feb 202401:43	–	nvd
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (February 19, 2024 to February 25, 2024)	29 Feb 202417:09	–	wordfence

Vulners

Node

profilepress_membership_team profilepressRange≤4.14.4

Source	Link
wordpress	www.wordpress.org/plugins/wp-user-avatar/
cve	www.cve.org/CVERecord
wordfence	www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-user-avatar/profilepress-4144-authenticated-contributor-stored-cross-site-scripting-via-edit-profile-text-box-shortcode

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

20 Feb 2024 00:00Current

6.0Medium risk

Vulners AI Score6.0

CVSS36.4