CVE-2024-1519: 
WordPress vulnerability analysis and mitigation

The ProfilePress WordPress plugin (formerly wp-user-avatar) contains a Stored Cross-Site Scripting vulnerability (CVE-2024-1519) in versions up to and including 4.14.4. The vulnerability exists in the 'name' parameter due to insufficient input sanitization and output escaping. This security issue affects the plugin when a member listing page is active and using the Gerbera theme (NVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). It has received a CVSS v3.1 base score of 6.1 (MEDIUM) from NIST with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, while Wordfence assigned a slightly higher score of 6.5 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N (NVD, WPScan).

When exploited, this vulnerability allows unauthenticated attackers to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an injected page, potentially leading to data theft or manipulation of user actions (NVD).

The vulnerability can be exploited by unauthenticated attackers, requiring only that a member listing page is active and using the Gerbera theme. No special privileges are needed to exploit this vulnerability (WPScan).

The vulnerability has been patched in version 4.15.0 of the ProfilePress plugin. Users are advised to update to this version or later to protect against this security issue (WPScan).