CVE-2023-4798

CVE-2023-4798 affects the WordPress plugin User Avatar – Reloaded (pre-1.2.2). It enables Stored XSS via certain shortcode attributes, reachable by low-privilege users (contributor+). The fixed version is 1.2.2, which adds sanitization/escaping to address the flaw (as confirmed by Patchstack and ...