CVE-2026-54865: WordPress Podamibe Custom User Gravatar plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability

Q: Which users can exploit this issue?

The vulnerability is described as subscriber XSS, so a user with Subscriber-level access can exploit it. Exploitation also requires user interaction.

Q: Can this be exploited remotely?

Yes. The attack vector is network-based and has low attack complexity, but the attacker must be authenticated with low-level privileges and must rely on user interaction.

Q: What is the potential impact if exploitation succeeds?

The vulnerability has scope changed and can affect confidentiality, integrity, and availability at low impact levels. It is rated medium severity with a CVSS score of 6.5.

Published Oct 29, 2026

Updated

Subscriber Cross Site Scripting (XSS) in Podamibe Custom User Gravatar <= 1.0.8 versions.

Event History

Oct 29, 2026

CVE Published

via MITRE·03:24 PM

Data Sourced

via MITRE·03:24 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which users can exploit this issue?

The vulnerability is described as subscriber XSS, so a user with Subscriber-level access can exploit it. Exploitation also requires user interaction.

Can this be exploited remotely?

Yes. The attack vector is network-based and has low attack complexity, but the attacker must be authenticated with low-level privileges and must rely on user interaction.

What is the potential impact if exploitation succeeds?

The vulnerability has scope changed and can affect confidentiality, integrity, and availability at low impact levels. It is rated medium severity with a CVSS score of 6.5.

CVE-2026-54865: WordPress Podamibe Custom User Gravatar plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability

Event History

Frequently Asked Questions

Which users can exploit this issue?

Can this be exploited remotely?

What is the potential impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

Can this be exploited remotely?

What is the potential impact if exploitation succeeds?