Medium severity · published Aug 2, 2021
CVE-2021-24450
The User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.8 did not sanitise or escape some of its settings…
4.8
CVSS
0.7%
EPSS
No
On KEV
Description
The User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.8 did not sanitise or escape some of its settings before saving them and outputting them back in the page, allowing high privilege users such as admin to set JavaScript payloads in them even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
Profilepress · Properfraction
before 3.1.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-24450
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-24450
Exploit
https://wpscan.com/vulnerability/a8625579-fe8f-4bc1-a641-0e26ad141c92
More from Profilepress
9.8
CVE-2024-9947
ProfilePress - Pro <= 4.11.1 - Authentication Bypass via WordPress.com OAuth provider
9.8
CVE-2021-34624
A vulnerability in the file uploader component found in the ~/src/Classes/FileUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary…
9.8
CVE-2021-34623
A vulnerability in the image uploader component found in the ~/src/Classes/ImageUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload…
9.8
CVE-2021-34621
A vulnerability in the user registration component found in the ~/src/Classes/RegistrationAuth.php file of the ProfilePress WordPress plugin made it possible for users to register…
8.8
CVE-2021-34622
A vulnerability in the user profile update component found in the ~/src/Classes/EditUserProfile.php file of the ProfilePress WordPress plugin made it possible for users to…