# Gravatar Enhanced <= 0.13.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gravatar Profile Block Attributes

- **ID:** WPSEC-2026-1189
- **Plugin:** Gravatar Enhanced – Avatars, Profiles, and Privacy (`gravatar-enhanced`), https://wordpress.org/plugins/gravatar-enhanced/
- **Affected versions:** from 0.3.0 before 0.14.0
- **Fixed in:** 0.14.0 (Update to 0.14.0 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-17)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/gravatar-enhanced
- **Fix released:** 2026-10-16
- **Published:** 2026-10-17
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1189/

## Description

The Gravatar Enhanced plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Gravatar Profile block's 'placeholderProfile' attribute in all versions up to, and including, 0.13.1, due to insufficient input sanitization and output escaping. The block's server-side renderer passes the whole attribute (including fields such as profile_url, avatar_url and verified_accounts) to the front-end script. The script then inserts these values into innerHTML without escaping attribute values or restricting URL schemes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

## References

- https://wpsec.com/vuln/WPSEC-2026-1189/
- https://plugins.svn.wordpress.org/gravatar-enhanced/tags/0.14.0/
- https://wordpress.org/plugins/gravatar-enhanced/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1189/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.