ProfilePress < 4.13.2 Cross-Site Request Forgery via 'admin_notice'

Description

The ProfilePress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.13.1. This is due to missing or incorrect nonce validation on the 'admin_notice' function. This makes it possible for unauthenticated attackers to dismiss admin notices granted they can trick a site administrator into performing an action such as clicking on a link. The impact of this vulnerability is unknown.