One User Avatar | User Profile Picture <= 2.5.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wpua-file Parameter
high
The One User Avatar | User Profile Picture plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.5.4 via the wpua_action_process_option_update function. This is due to insufficient file type validation in wp_handle_upload() called without a MIME allow-list, with post-...
- CVSS:
- 7.5
- Affected:
- up to 2.5.4
- Fixed in:
- 2.5.5
- Disclosed:
- Aug 27, 2026
CVE-2026-18983 on NVD →
One User Avatar <= 2.3.6 - Cross-Site Request Forgery
medium
The One User Avatar WordPress plugin before 2.3.7 does not check for CSRF when updating the Avatar in page where the [avatar_upload] shortcode is embed. As a result, attackers could make logged in user change their avatar via a CSRF attack
- CVSS:
- 6.5
- Affected:
- up to 2.3.7
- Fixed in:
- 2.3.7
- Disclosed:
- Sep 20, 2021
CVE-2021-24675 on NVD →
One User Avatar <= 2.3.6 - Stored Cross-Site Scripting
medium
The One User Avatar WordPress plugin before 2.3.7 does not escape the link and target attributes of its shortcode, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks
- CVSS:
- 5.4
- Affected:
- up to 2.3.7
- Fixed in:
- 2.3.7
- Disclosed:
- Sep 20, 2021
CVE-2021-24672 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database