Live › vulnerability › CVE-2026-54865
The Custom User Gravatar WordPress plugin up to version 1.0.8 has a cross-site scripting flaw that a low-privilege Subscriber account can trigger. A successful attack runs attacker-supplied JavaScript in the browser of another user, such as an administrator who views the affected page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Sites running the Custom User Gravatar plugin at version 1.0.8 or earlier, where users can register with the Subscriber role. The sources do not say whether default configurations are affected. Sites without this plugin are not affected.
No product ranges from the sources yet.
wp-content/plugins/ for the Custom User Gravatar folder.1.0.8 or earlier.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Subscriber Cross Site Scripting (XSS) in Podamibe Custom User Gravatar <= 1.0.8 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-54865")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.