CVE-2022-0233: ProfileGrid – User Profiles, Memberships, Groups and Communities <= 4.7.4 Authenticated Stored Cross-Site Scripting
The ProfileGrid – User Profiles, Memberships, Groups and Communities WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the pmuseravatar and pmcoverimage parameters found in the ~/admin/class-profile-magic-admin.php file which allows attackers with authenticated user access, such as subscribers, to inject arbitrary web scripts into their profile, in versions up to and including 1.2.7.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the vulnerability ID for the ProfileGrid plugin vulnerability?
The vulnerability ID for the ProfileGrid plugin vulnerability is CVE-2022-0233.
What is the severity of CVE-2022-0233?
The severity of CVE-2022-0233 is medium with a CVSS score of 5.4.
Which software versions are affected by CVE-2022-0233?
The ProfileGrid plugin version up to and including 4.7.4 for WordPress is affected by CVE-2022-0233.
What is the CWE category for CVE-2022-0233?
The CWE category for CVE-2022-0233 is CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')).
How can I fix the ProfileGrid plugin vulnerability?
To fix the ProfileGrid plugin vulnerability, it is recommended to update to a version higher than 4.7.4.