CVE-2024-13120: 
WordPress vulnerability analysis and mitigation

The vulnerability (CVE-2024-13120) affects the ProfilePress WordPress plugin (formerly wp-user-avatar) versions below 4.15.20. This security issue was discovered in the plugin's form handling functionality, specifically related to the sanitization and escaping of settings in the Drag & Drop Form feature (WPScan).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue with a CVSS score of 3.5 (low severity). The security flaw exists because the plugin fails to properly sanitize and escape certain settings, particularly in the form builder interface. This vulnerability is specifically related to the 'Remember me' field's description setting in the form builder (WPScan).

The vulnerability allows high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, even in environments where the unfiltered_html capability is disabled, such as in multisite WordPress installations (WPScan).

The vulnerability has been patched in version 4.15.20 of the ProfilePress plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).