SZB-4bdd5e6eca
EUVD lists subscriber XSS flaw in Podamibe Custom User Gravatar up to 1.0.8
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Podamibe
- Product
- Podamibe Custom User Gravatar
- First seen
Summary
The EU Vulnerability Database (EUVD) lists a subscriber-level cross-site scripting vulnerability in Podamibe Custom User Gravatar versions up to 1.0.8, scored 6.5/10 (CVSS v3.1). The entry was published 2026-10-29 and updated 2026-10-30, and the item reports no known exploitation.
If you use Podamibe
Update Custom User Gravatar to a version later than 1.0.8 when a fix is available
Check the EUVD entry EUVD-2026-112954 for patch status
Limit subscriber account access until the plugin is patched
What the sources say 1
· Mastodon: “Subscriber Cross Site Scripting (XSS) in Podamibe Custom User Gravatar <= 1.0.8 versions.” Source