Vulnerability · Published Oct 16, 2023 · Assigned by WPScan
CVE-2023-4798User Avatar - Reloaded < 1.2.2 - Contributor+ Stored XSS
Medium 5.4
In plain English
A medium-severity security flaw in User Avatar from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).
Severity (CVSS NVD)5.4Medium
Exploit odds (30 days)0.5%top 60.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The User Avatar WordPress plugin before 1.2.2 does not properly sanitize and escape certain of its shortcodes attributes, which could allow relatively low-privileged users like contributors to conduct Stored XSS attacks.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | User Avatar | 0 – before 1.2.2 |
References
- https://wpscan.com/vulnerability/273a95bf-39fe-4ba7-bc14-9527acfd9f42 exploit, vdb-entry, technical-description