Medium severity6.4NVD Advisory· Published Jan 18, 2022· Updated Jun 17, 2026
CVE-2022-0233
CVE-2022-0233
Description
The ProfileGrid – User Profiles, Memberships, Groups and Communities WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the pm_user_avatar and pm_cover_image parameters found in the ~/admin/class-profile-magic-admin.php file which allows attackers with authenticated user access, such as subscribers, to inject arbitrary web scripts into their profile, in versions up to and including 1.2.7.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: <=1.2.7
- ProfileGrid – User Profiles, Memberships, Groups and Communities/ProfileGrid – User Profiles, Memberships, Groups and Communitiesv5Range: 4.7.4
Patches
Vulnerability mechanics
References
3- github.com/BigTiger2020/2022/blob/main/ProfileGrid%20Xss.mdnvdExploitThird Party Advisory
- plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/tags/4.7.4/admin/class-profile-magic-admin.phpnvdThird Party Advisory
- www.wordfence.com/vulnerability-advisories/nvdThird Party Advisory
News mentions
0No linked articles in our index yet.