WordPress Plugin Vulnerabilities

ProfilePress < 4.15.0 - Unauthenticated Stored XSS

Description

The plugin is vulnerable to Stored Cross-Site Scripting via the 'name' parameter due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires a member listing page to be active and using the Gerbera theme.

Affects Plugins

Plugin icon
wp-user-avatar
Fixed in 4.15.0

References

CVE
CVE-2024-1519
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/4ffd74de-6629-4088-ba5c-ac9dd5c6322c

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.0 (medium)

Miscellaneous

Original Researcher
stealthcopter
Verified
No
WPVDB ID
ca19ed80-968d-4881-bd4a-33562f3ecca4

Timeline

Publicly Published
2024-02-19 (about 2 years ago)
Added
2024-02-20 (about 2 years ago)
Last Updated
2024-02-20 (about 2 years ago)

Other

Published
Title
Published
2025-01-07
Title
Scan External Links <= 1.0 - Reflected Cross-Site Scripting
Published
2024-12-17
Title
Tabs Shortcode <= 2.0.2 - Contributor+ XSS via Shortcode
Published
2025-06-11
Title
Track, Analyze & Optimize by WP Tao < 1.3.1 - Reflected Cross-Site Scripting
Published
2026-04-14
Title
List View Google Calendar < 7.4.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Event Description
Published
2025-12-11
Title
WPLG Default Mail From <= 1.0.0 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']