Lucene search
WpvulndbWPVDB-ID:5C948E04-D998-4032-85A9-1D9A42B3E160HistoryJan 18, 2022 - 12:00 a.m.
ProfileGrid < 4.7.5 - Subscriber+ Stored Cross-Site Scripting
2022-01-1800:00:00
wpscan.com
11
0.001 Low
EPSS
Percentile
26.6%
The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the pm_user_avatar and pm_cover_image parameters found in the ~/admin/class-profile-magic-admin.php file which allows attackers with authenticated user access, such as subscribers, to inject arbitrary web scripts into their profile.
| CPE | Name | Operator | Version |
|---|---|---|---|
| profilegrid-user-profiles-groups-and-communities | lt | 4.7.5 |
Related
cvelist
cvelist
nvd
nvd
CVE-2022-0233
2022-01-18 17:15:10
cve
cve
CVE-2022-0233
2022-01-18 17:15:10
prion
prion
Cross site scripting
2022-01-18 17:15:00
patchstack
patchstack