CVE-2024-8861: ProfileGrid – User Profiles, Groups and Communities <= 5.9.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.9.3.2 due to incorrect use of the wpksesallowedhtml function, which allows the 'onclick' attribute for certain HTML elements without sufficient restriction or context validation. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8861?
CVE-2024-8861 is classified as a high-severity vulnerability due to its potential for Stored Cross-Site Scripting attacks.
How do I fix CVE-2024-8861?
To mitigate CVE-2024-8861, update the ProfileGrid plugin to version 5.9.3.3 or later.
Which versions of ProfileGrid are affected by CVE-2024-8861?
CVE-2024-8861 affects all versions of the ProfileGrid plugin up to and including version 5.9.3.2.
What type of vulnerability is CVE-2024-8861?
CVE-2024-8861 is a Stored Cross-Site Scripting (XSS) vulnerability.
Who is the vendor responsible for CVE-2024-8861?
The vendor responsible for CVE-2024-8861 is Metagauss, the developer of the ProfileGrid plugin.