Untriaged
Permalink
CVE-2023-46621
6.1 MEDIUM
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): LOW
- Privileges required (PR): NONE
- User interaction (UI): REQUIRED
- Scope (S): CHANGED
- Confidentiality impact (C): LOW
- Integrity impact (I): LOW
- Availability impact (A): NONE
WordPress User Avatar Plugin <= 1.4.11 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Enej Bajgoric / Gagan Sandhu / CTLT DEV User Avatar plugin <= 1.4.11 versions.
References
- https://patchstack.com/database/vulnerability/user-avatar/wordpress-user-avatar… vdb-entry
- https://patchstack.com/database/vulnerability/user-avatar/wordpress-user-avatar… vdb-entry x_transferred
- https://patchstack.com/database/vulnerability/user-avatar/wordpress-user-avatar… vdb-entry
- https://patchstack.com/database/vulnerability/user-avatar/wordpress-user-avatar… vdb-entry x_transferred
- https://patchstack.com/database/vulnerability/user-avatar/wordpress-user-avatar… vdb-entry
- https://patchstack.com/database/vulnerability/user-avatar/wordpress-user-avatar… vdb-entry x_transferred
Affected products
user-avatar
- =<1.4.11
Matching in nixpkgs
-
nixos-unstable -
- nixpkgs-unstable 1.4.1
pkgs.gnomeExtensions.user-avatar-in-quick-settings
Display the user avatar in the Quick Settings menu, part of the "System" settings
-
nixos-unstable -
- nixpkgs-unstable 9
Package maintainers
-
@honnip Jung seungwoo <me@honnip.page>