Impact Analysis

This vulnerability can allow attackers with low-level access to inject malicious scripts that execute in other users' browsers. This can lead to theft of user credentials, session hijacking, defacement, or other malicious actions performed on behalf of the victim user. Since the vulnerability is stored, the malicious code persists and affects multiple users who access the injected content.

Useful 0 Not Useful 0

Executive Summary

The ProfileGrid plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in the 'pm_author_message' parameter within the pm_send_message_to_author function. This occurs because the plugin does not properly sanitize input or escape output, allowing authenticated users with Subscriber-level access or higher to inject malicious scripts. These scripts execute whenever a user views the affected page.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update the ProfileGrid – User Profiles, Groups and Communities plugin for WordPress to a version later than 5.9.9.2, as all versions up to and including 5.9.9.2 are vulnerable.

Note that the vulnerability was partially patched in version 5.9.8.5, but a full fix requires updating beyond 5.9.9.2.

Additionally, restrict Subscriber-level and above users from sending messages via the vulnerable 'pm_author_message' parameter if updating immediately is not possible.

Useful 0 Not Useful 0