CVE-2023-4798: Wpexperts User Avatar-Reloaded

Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days.

The User Avatar WordPress plugin before 1.2.2 does not properly sanitize and escape certain of its shortcodes attributes, which could allow relatively low-privileged users like contributors to conduct Stored XSS attacks.

Affected products

• Wpexperts User Avatar-Reloaded: before 1.2.2 (fixed in 1.2.2)

Published 2023-10-16. Last modified 2026-06-17.