CVE-2024-1535: 
WordPress vulnerability analysis and mitigation

The ProfilePress WordPress plugin (also known as wp-user-avatar) contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 4.15.2. The vulnerability exists due to insufficient input sanitization and output escaping on user-supplied attributes in the plugin's shortcode(s) (NVD).

The vulnerability is tracked as CVE-2024-1535 and has been assigned a CVSS v3.1 Base Score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The issue stems from improper handling of user input in the plugin's shortcode functionality, which fails to properly sanitize and escape user-supplied attributes (NVD).

This vulnerability allows authenticated attackers with contributor-level permissions or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an affected page, potentially leading to unauthorized actions and data exposure (NVD).

The vulnerability requires an authenticated user with at least contributor-level permissions to exploit. The attack complexity is considered low, requiring user interaction for successful exploitation (NVD).

Users should update to ProfilePress version 4.15.3 or later which contains the fix for this vulnerability. The patch addresses the input sanitization and output escaping issues in the plugin's shortcode functionality (NVD).