User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor, CVE-2021-24448
- CVE, Research URL
- Home page URL
- Application
-
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
- Published on
- Aug 02, 2021
- Research Description
- The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.8 does not sanitise or escape its 'Modify default Redirect Delay timer' setting, allowing high privilege users to use JavaScript code in it, even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
- Affected versions
-
Min -, max 3.4.8.
- Status
-
vulnerable