{
 "id": "WPSEC-2026-2339",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2339/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2339/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2339/index.md",
 "title": "Gravatar Enhanced <= 0.14.0 - Unauthenticated Stored Cross-Site Scripting via Gravatar Hovercard Profile Data",
 "description": "The Gravatar Enhanced plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Gravatar profile data rendered in avatar hovercards in versions 0.7.0 up to, and including, 0.14.0, due to the bundled hovercards script inserting payment link labels and URLs, crypto wallet labels and addresses, and contact information values into the page with innerHTML without HTML escaping or URL protocol validation. This makes it possible for unauthenticated attackers who control a Gravatar profile, for example by posting a comment with the associated email address, to inject arbitrary web scripts that execute when a site visitor or administrator hovers over the attacker's avatar, provided the Gravatar service returns the stored values unfiltered.",
 "plugin": {
  "slug": "gravatar-enhanced",
  "name": "Gravatar Enhanced",
  "full_name": "Gravatar Enhanced – Avatars, Profiles, and Privacy",
  "wordpress_org": "https://wordpress.org/plugins/gravatar-enhanced/",
  "advisories_url": "https://wpsec.com/vuln/plugin/gravatar-enhanced/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/gravatar-enhanced"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "0.7.0",
    "from_inclusive": true,
    "to": "0.15.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 0.7.0 before 0.15.0"
  ]
 },
 "introduced_in": "0.7.0",
 "fixed_in": "0.15.0",
 "remediation": "Update to 0.15.0 or later.",
 "fix_released": "2026-10-30T21:30:46+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:39:26.163779+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2339/",
  "https://plugins.svn.wordpress.org/gravatar-enhanced/tags/0.15.0/",
  "https://wordpress.org/plugins/gravatar-enhanced/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/gravatar-enhanced",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-03"
 }
}