Stored Cross-Site Scripting in ProfilePress Plugin for WordPress
CVE-2022-4697
5.5MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 23 December 2022
What is CVE-2022-4697?
The ProfilePress plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate sanitization of the 'wp_user_cover_default_image_url' parameter. This vulnerability allows authenticated users with administrator or higher privileges to embed malicious scripts, which can be executed when other users visit affected pages. The issue predominantly impacts multi-site configurations and those with disabled unfiltered_html settings, making it crucial for administrators to implement necessary security measures and update their installations.
Affected Version(s)
Paid Membership, Ecommerce, Registration Form, Login Form, User Profile, Paywall & Restrict Content – ProfilePress * <= 4.5.0