WordPress Plugin Vulnerabilities

Profile Builder <= 3.12.0 - Admin+ Stored Cross Site Scripting

Description

The plugin does not sanitise and escape some parameters before outputting its content on the admin area, which allows Admin+ users to perform Cross-Site Scripting attacks.

Proof of Concept

Affects Plugins

Plugin icon
profile-builder
Fixed in 3.12.2

References

CVE
CVE-2024-6708

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.5 (low)

Miscellaneous

Original Researcher
John Castro
Submitter
John Castro
Verified
Yes
WPVDB ID
b6822bd9-f9f9-41a4-ad19-019b1f03bd4c

Timeline

Publicly Published
2024-07-10 (about 1 year ago)
Added
2024-08-13 (about 1 year ago)
Last Updated
2024-08-13 (about 1 year ago)

Other

Published
Title
Published
2025-04-15
Title
Tourmaster < 5.4.1 - Reflected Cross-Site Scripting
Published
2024-05-22
Title
Spectra – WordPress Gutenberg Blocks < 2.12.9 - Contributor+ Stored XSS via Testimonial Block
Published
2024-05-15
Title
Custom Post Type Attachment < 3.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via pdf_attachment Shortcode
Published
2024-01-05
Title
Mapster WP Maps < 1.2.39 - Contributor+ Stored XSS
Published
2023-07-20
Title
TS Webfonts for さくらのレンタルサーバ < 3.1.1 - Admin+ Stored Cross-Site Scripting