ProfileGrid User Profiles, Groups and Communities Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in the ProfileGrid – User Profiles, Groups and Communities plugin for WordPress, affecting all versions through 5.9.5.4. The issue arises in the 'pm_get_messenger_notification' function, where inadequate input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts. These scripts can be executed if a logged-in user is tricked into clicking a link or performing a similar action.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user.

Reproduction

To reproduce this vulnerability, an attacker must craft a link that exploits the 'pm_get_messenger_notification' function. This link should include a payload that injects a script, taking advantage of the lack of proper input validation and output escaping. Once the link is clicked by a logged-in user, the injected script will execute, demonstrating the cross-site scripting vulnerability.

Remediation

Users are advised to update the ProfileGrid – User Profiles, Groups and Communities plugin to version 5.9.5.5 or later.