{"id":"CVE-2026-54865","kind":"vulnerability","aliases":["CVE-2026-54865"],"related":[],"title":"Custom User Gravatar WordPress plugin: subscribers can inject scripts","description":"Subscriber Cross Site Scripting (XSS) in Podamibe Custom User Gravatar <= 1.0.8 versions.","summary":"The Custom User Gravatar WordPress plugin up to version 1.0.8 has a cross-site scripting flaw that a low-privilege Subscriber account can trigger. A successful attack runs attacker-supplied JavaScript in the browser of another user, such as an administrator who views the affected page.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/` for the Custom User Gravatar folder.\n- Flag any install at version `1.0.8` or earlier.","fix":null,"status":"open","published_at":"2026-10-29T16:18:10+00:00","first_seen_at":"2026-10-29T16:25:59+00:00","triaged_at":"2026-10-29T16:31:20+00:00","updated_at":"2026-10-29T16:31:20+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T16:31:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Custom User Gravatar WordPress plugin: subscribers can inject scripts","impact":"medium","summary":"The Custom User Gravatar WordPress plugin up to version 1.0.8 has a cross-site scripting flaw that a low-privilege Subscriber account can trigger. A successful attack runs attacker-supplied JavaScript in the browser of another user, such as an administrator who views the affected page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker script runs in another user's browser session","analyst_note":"Check the NVD entry and the WordPress plugin repository changelog for a fixed version and the exact vulnerable input.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/` for the Custom User Gravatar folder.\n- Flag any install at version `1.0.8` or earlier.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Custom User Gravatar plugin at version 1.0.8 or earlier, where users can register with the Subscriber role. The sources do not say whether default configurations are affected. Sites without this plugin are not affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000678,"input_tokens":4079,"output_tokens":540,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-54865':12A,15A '1.0.8':33B,83C 'account':47B 'administr':67B 'affect':71B 'anoth':62B 'attack':52B,55B 'attacker-suppli':54B 'browser':60B 'cross':37B,74C 'cross-sit':36B 'custom':1A,25B,80C 'cve':10A,13A 'flaw':40B 'gravatar':3A,27B,82C 'host':19B 'inject':8A 'javascript':57B 'low':44B 'low-privileg':43B 'packag':16B 'page':72B 'plugin':5A,23B,29B 'podamib':79C 'privileg':45B 'run':53B 'script':9A,39B,76C 'self':18B 'self-host':17B 'site':38B,75C 'subscrib':6A,46B,73C 'success':51B 'suppli':56B 'trigger':49B 'user':2A,26B,63B,81C 'version':32B,84C 'view':69B 'wordpress':4A,20B,22B,28B 'wordpress-plugin':21B 'xss':77C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Custom User Gravatar plugin at version 1.0.8 or earlier, where users can register with the Subscriber role. The sources do not say whether default configurations are affected. Sites without this plugin are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-54865","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54865","severity":null,"published_at":"2026-10-29T16:18:10+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:25:59+00:00","fetched_at":"2026-10-29T16:25:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}