A Cross-Site Scripting (XSS) vulnerability exists in ProfilePress wp-user-avatar plugin versions up to 4.17.7 due to improper neutralization of script-related HTML tags. This flaw allows an attacker to inject code into web pages, potentially leading to limited confidentiality impact. The vulnerability has a medium severity score of 5.3 and does not require user interaction or privileges to exploit. No public exploits or known active exploitation have been reported. No patch or remediation information is currently available.