| Package | Affected versions | Patched versions |
|---|---|---|
| profilegrid | ≤ 4.7.4 |
The ProfileGrid – User Profiles, Memberships, Groups and Communities WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the pm_user_avatar and pm_cover_image parameters found in the ~/admin/class-profile-magic-admin.php file which allows attackers with authenticated user access, such as subscribers, to inject arbitrary web scripts into their profile, in versions up to and including 1.2.7.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free