Podamibe Custom User Gravatar is a WordPress plugin that enables site administrators to display custom avatar images for users. The vulnerability allows a malicious actor to inject arbitrary HTML or JavaScript code that is rendered in the browsers of anyone who views the affected site. By exploiting this flaw an attacker can steal session cookies, deface the site, or redirect users to phishing pages. This is a classic reflected XSS flaw caused by insufficient input sanitization when outputting user‑supplied avatar data.

The flaw exists in all installations of Podamibe Custom User Gravatar version 1.0.8 or earlier on WordPress websites. Any site that has this plugin ready to accept avatar or user profile data from subscribers is vulnerable; the issue is tied to the plugin, not the core WordPress installation itself.

The CVSS score of 6.5 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA KEV, suggesting that exploit activity has not been reported to date. The inferred attack vector is that a subscriber or user who can add or edit their avatar data can inject malicious scripts that are then reflected when the site renders the avatar. Once an attacker succeeds, the stolen data is local to the visitor’s browser, but the impact on confidentiality, integrity, and availability is potentially significant for the victim audience.