Wp User Profile Avatar Vulnerabilities

The WP User Profile Avatar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.0.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 1.0.6

Fix:

No patched version reported

Disclosed:

Jun 19, 2025

CVE-2025-49980 on NVD →

The WP User Profile Avatar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.5. This is due to missing or incorrect nonce validation on the wpupa_user_admin() function. This makes it possible for unauthenticated attackers to update the plugins setting which contr...

CVSS:

4.3

Affected:

up to 1.0.5

Fixed in:

1.0.6

Disclosed:

Jan 15, 2025

CVE-2024-10789 on NVD →

The WP User Profile Avatar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contribu...

CVSS:

6.4

Affected:

up to 1.0.1

Fixed in:

1.0.3

Disclosed:

Mar 25, 2024

CVE-2023-6067 on NVD →

The WP User Profile Avatar plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0.0 via the remove_user_avatar and update_user_avatar functions due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to update and...

CVSS:

5.3

Affected:

up to 1.0.0

Fixed in:

1.0.1

Disclosed:

Dec 29, 2023

CVE-2023-6384 on NVD →

The WP User Profile Avatar plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in p...

CVSS:

6.4

Affected:

up to 1.0

Fixed in:

1.0.1

Disclosed:

Dec 28, 2023

CVE-2023-52118 on NVD →