Threat Investigation
Request a demo

CVE-2021-24450

Medium

Description

The User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.8 did not sanitise or escape some of its settings before saving them and outputting them back in the page, allowing high privilege users such as admin to set JavaScript payloads in them even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue

SeverityMedium
CVSS4.8
Exploit probability—
ProductProperfraction Profilepress
PublishedAug 2, 2021
First seenAug 2, 2021
Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Update
  • properfraction profilepress3.1.8 or later

Affected products

ProductAffected versionsFixed in
properfraction profilepressv < 3.1.83.1.8

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.