TI-2021-06739 Aliases CVE-2021-24450 GHSA-7949-q2p4-p63q

ProfilePress < 3.1.8 - Authenticated Stored XSS

LOW 23CWE-79Published 2021-08-02 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: High
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

The User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.8 did not sanitise or escape some of its settings before saving them and outputting them back in the page, allowing high privilege users such as admin to set JavaScript payloads in them even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue

Why it matters now

EPSS 0.00652 51st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) (Unknown): 3.1.8

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar)	3.1.8 to before 3.1.8	3.1.8	Patch available	CNA

User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) VendorUnknown Affected 3.1.8 to before 3.1.8 Fixed in 3.1.8 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:properfraction:profilepress::::::wordpress::*	before 3.1.8	Vulnerable	properfraction

cpe:2.3:a:properfraction:profilepress:*:*:*:*:*:wordpress:*:* Versions before 3.1.8 Vulnerable ·properfraction

Remediation

Fix · CNA User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) (Unknown) Fixed in 3.1.8

Timeline

2026-10-02 Threatist record created from CVE-2021-24450
2026-10-03 Alias added: GHSA-7949-q2p4-p63q
2026-10-14 EPSS moved to the 50th–90th percentile

References

Exploit 1

https://wpscan.com/vulnerability/a8625579-fe8f-4bc1-a641-0e26ad141c92

TI-2021-13635 ProfilePress 3.0 - 3.1.3 - Unauthenticated Privilege Escalation CVSS 3.1CRITICAL 9.8
TI-2021-13638 ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload in File Uploader Component CVSS 3.1CRITICAL 9.8
TI-2021-13637 ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload in Image Uploader Component CVSS 3.1CRITICAL 9.8
TI-2021-13636 ProfilePress 3.0 - 3.1.3 - Authenticated Privilege Escalation CVSS 3.1CRITICAL 9.8
TI-2024-12168 ProfilePress < 4.15.20 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8
TI-2024-12167 ProfilePress < 4.15.20 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8

See all 33 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences