User Avatar - Reloaded < 1.2.2 - Contributor+ Stored XSS
published October 16, 2023
CVSS
—
EPSS
0%
Percentile
38.8
In the wild
Unconfirmed
What it is
The User Avatar WordPress plugin before 1.2.2 does not properly sanitize and escape certain of its shortcodes attributes, which could allow relatively low-privileged users like contributors to conduct Stored XSS attacks.
The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00459 · 38.8th percentile
Published
2023-10-16T19:39Z
EPSS history
Timeline
16 OCT 19:39Z
User Avatar - Reloaded < 1.2.2 - Contributor+ Stored XSS