PT-2024-18121 · WordPress · Profilepress

🗓️ 13 Mar 2024 00:00:00Reported by Positive TechnologiesType

ptsecurity

ptsecurity🔗 dbugs.ptsecurity.com👁 1 Views

Stored XSS in ProfilePress up to 4.15.2 via shortcodes; update past 4.15.2 and restrict access.

Reporter	Title	Published	Views	Family All 12
CNNVD	WordPress Plugin ProfilePress Security Vulnerability	13 Mar 202400:00	–	cnnvd
CVE	CVE-2024-1535	13 Mar 202415:26	–	cve
Cvelist	CVE-2024-1535 ProfilePress <= 4.15.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	13 Mar 202415:26	–	cvelist
EUVD	EUVD-2024-17283	3 Oct 202520:07	–	euvd
NVD	CVE-2024-1535	13 Mar 202416:15	–	nvd
OpenVAS	WordPress ProfilePress Plugin < 4.15.3 XSS Vulnerability	5 Feb 202500:00	–	openvas
Patchstack	WordPress ProfilePress Plugin <= 4.15.2 is vulnerable to Cross Site Scripting (XSS)	12 Mar 202400:00	–	patchstack
Prion	Cross site scripting	13 Mar 202416:15	–	prion
RedhatCVE	CVE-2024-1535	23 May 202509:59	–	redhatcve
Vulnrichment	CVE-2024-1535	13 Mar 202415:26	–	vulnrichment

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-1535
plugins	www.plugins.trac.wordpress.org/changeset/3047008/wp-user-avatar/trunk/src/ShortcodeParser/Builder/FieldsShortcodeCallback.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/38ec1a6b-f5ee-446a-9e6c-3485dafb85ac
t	www.t.me/cvenotify/108288
github	www.github.com/WordpressPluginDirectory/wp-user-avatar/blob/fde360946c86d67610d8f95a82752199ce25b39a/wp-user-avatar/src/ShortcodeParser/Builder/FieldsShortcodeCallback.php
twitter	www.twitter.com/CVEnew/status/1767941851573596289
cve	www.cve.mitre.org/cgi-bin/cvename.cgi

22 Jan 2025 00:00Current

7.9High risk

Vulners AI Score7.9

CVSS 3.15.4 - 6.4

EPSS0.00278

SSVC

cross site scripting ProfilePress plugin WordPress plugin version 4.15.2 shortcodes vulnerability update required access restriction