CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin <= 4.5.3 versions.
Explanation of Vulnerability in Simple Terms
ProfilePress versions up to 4.5.3 contain a stored cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into the site. An attacker can craft a malicious input that, when viewed by site visitors or administrators, executes JavaScript in their browsers. This can lead to session hijacking, credential theft, or malware distribution. The vulnerability requires user interaction to trigger.
What an attacker can do
Inject malicious JavaScript that runs in visitors' browsers when they view affected pages or forms.
Potential impact on your site
Visitors and admins may have sessions hijacked, credentials stolen, or be redirected to malicious sites.
Conditions required to exploit
No authentication required. Victim must visit a page containing the attacker's injected payload.
Key dates
External resources
Related vulnerabilities
