PT-2024-39279 · WordPress · Profilegrid

Francesco Carlucci

·

Published

2024-09-26

·

Updated

2024-10-01

·

CVE-2024-8861

CVSS v3.1

6.4

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions: ProfileGrid – User Profiles, Groups and Communities plugin for WordPress versions up to, and including, 5.9.3.2
Description: The issue is related to Stored Cross-Site Scripting due to the incorrect use of the wp kses allowed html function. This function allows the onclick attribute for certain HTML elements without sufficient restriction or context validation, making it possible for authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages. These scripts will execute whenever a user accesses an injected page.
Recommendations: For versions up to, and including, 5.9.3.2, update to a version higher than 5.9.3.2 to resolve the issue. As a temporary workaround, consider restricting access to the wp kses allowed html function or disabling the onclick attribute for certain HTML elements until a patch is available. Additionally, restrict Contributor-level access and above to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-8861

Affected Products

Profilegrid