ProfilePress < 4.15.0 - Unauthenticated Stored XSS

2024-02-2000:00:00

wpscan.com

profilepress

xss

unauthenticated

stored

cross-site scripting

input sanitization

output escaping

gerbera theme

web scripts

vulnerability

5.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.6%

JSON

Description The plugin is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires a member listing page to be active and using the Gerbera theme.