CVE-2022-0233mediumCWE-79

CVE-2022-0233: falha de média gravidade em ProfileGrid – User Profiles, Memberships…

ProfileGrid – User Profiles, Memberships, Groups and Communities <= 4.7.4 Authenticated Stored Cross-Site Scripting

Publicada em 18 jan 2022 · Atualizada em 13 fev 2025

Seguir esta CVE + Monitorar ProfileGrid – User Profiles, Memberships, Groups and Communities

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.4epss 0.9%

The ProfileGrid – User Profiles, Memberships, Groups and Communities WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the pm_user_avatar and pm_cover_image parameters found in the ~/admin/class-profile-magic-admin.php file which allows attackers with authenticated user access, such as subscribers, to inject arbitrary web scripts into their profile, in versions up to and including 1.2.7.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Produtos afetados

ProfileGrid – User Profiles, Memberships, Groups and Communities · ProfileGrid – User Profiles, Memberships, Groups and Communities

Referências

https://github.com/BigTiger2020/2022/blob/main/ProfileGrid%20Xss.md https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/tags/4.7.4/admin/class-profile-magic-admin.php#L961 https://www.wordfence.com/vulnerability-advisories/#CVE-2022-0233