Stored Cross-Site Scripting Vulnerability in ProfileGrid Plugin

CVE-2024-8861

What is CVE-2024-8861?

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress has a vulnerability that allows for Stored Cross-Site Scripting due to the improper implementation of the wp_kses_allowed_html function. This flaw exists in all versions up to and including 5.9.3.2. It permits authenticated users with Contributor-level access and above to exploit the system by injecting malicious web scripts into pages. These scripts will execute whenever an affected page is accessed by any user, potentially compromising the security of the website and its users.

References