Peprodev Ultimate Profile Solutions
Monthly
Stored cross-site scripting in the PeproDev Ultimate Profile Solutions WordPress plugin (all versions up to and including 8.2.36) allows an authenticated attacker holding contributor-level privileges or higher to inject arbitrary JavaScript into a page via the 'button' attribute of the shortcode, which is stored without sanitization and rendered without output escaping. The payload executes in the browser of any user who later views the injected page, and because the injected content lives in persistent post data it can trigger against administrators and other privileged viewers. Rated CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N); no public exploit code has been identified at time of analysis and there is no indication of active exploitation, so this should be treated as a moderate-priority issue rather than an emergency.
Stored cross-site scripting in the PeproDev Ultimate Profile Solutions WordPress plugin (all versions up to and including 8.2.36) allows an authenticated attacker holding contributor-level privileges or higher to inject arbitrary JavaScript into a page via the 'button' attribute of the shortcode, which is stored without sanitization and rendered without output escaping. The payload executes in the browser of any user who later views the injected page, and because the injected content lives in persistent post data it can trigger against administrators and other privileged viewers. Rated CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N); no public exploit code has been identified at time of analysis and there is no indication of active exploitation, so this should be treated as a moderate-priority issue rather than an emergency.