Lucene search
WpvulndbWPVDB-ID:16D825FE-1F20-4C29-B73C-7806F81717A5HistoryDec 23, 2022 - 12:00 a.m.
ProfilePress < 4.5.1 - Admin+ Stored Cross-Site Scripting via Form Settings
2022-12-2300:00:00
wpscan.com
13
profilepress
cross-site scripting
form settings
admin+
web scripts
multisite
0.0005 Low
EPSS
Percentile
18.0%
The plugin does not sanitize and escape several form fields before outputting them to pages on the site, allowing authenticated (admin+) users to inject arbitrary web scripts even when unfiltered html has been disabled (such as in a multisite setup).
| CPE | Name | Operator | Version |
|---|---|---|---|
| wp-user-avatar | lt | 4.5.1 |
Related
prion
prion
Cross site scripting
2022-12-23 16:15:00
cve
cve
CVE-2022-4698
2022-12-23 16:15:13
nvd
nvd
CVE-2022-4698
2022-12-23 16:15:13
cvelist
cvelist
CVE-2022-4698
2022-12-23 15:09:51