Skip to content
Unknown User Avatar vulnerabilities
-
onedesigns one user avatar | user profile picture
One User Avatar | User Profile Picture <= 2.5.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wpua-file Parameter
CVE-2026-18983
7.5 High
-
enej bajgoric / gagan sandhu / ctlt dev user avatar
WordPress User Avatar Plugin <= 1.4.11 is vulnerable to Cross Site Scripting (XSS)
CVE-2023-46621
7.1 High
-
unknown user avatar, wpexperts user avatar-reloaded +1 more
User Avatar - Reloaded < 1.2.2 - Contributor+ Stored XSS
CVE-2023-4798
5.4 Medium
-
profilepress user registration\, login form\, user profile \& membership, unknown user registration, login form, user profile & membership – profilepress (formerly wp user avatar) +1 more
ProfilePress < 3.2.3 - Reflected Cross-Site Scripting
CVE-2021-24955
6.1 Medium
-
profilepress user registration\, login form\, user profile \& membership, unknown user registration, login form, user profile & membership – profilepress (formerly wp user avatar) +1 more
ProfilePress < 3.2.3 - Reflected Cross-Site Scripting
CVE-2021-24954
6.1 Medium
-
onedesigns one user avatar, unknown one user avatar | user profile picture +1 more
One User Avatar < 2.3.7 - Avatar Update via CSRF
CVE-2021-24675
6.5 Medium
-
onedesigns one user avatar, unknown one user avatar | user profile picture +1 more
One User Avatar < 2.3.7 - Contributor+ Stored Cross-Site Scripting
CVE-2021-24672
5.4 Medium
-
properfraction profilepress, unknown user registration, user profile, login & membership – profilepress (formerly wp user avatar) +1 more
ProfilePress < 3.1.11 - Unauthenticated Cross-Site Scripting (XSS) in tabbed login/register widget
CVE-2021-24522
6.1 Medium
-
properfraction profilepress, unknown user registration, user profiles, login & membership – profilepress (formerly wp user avatar) +1 more
ProfilePress < 3.1.8 - Authenticated Stored XSS
CVE-2021-24450
4.8 Medium