CVE-2026-18983: Unrestricted Upload of File with Dangerous Type

The One User Avatar | User Profile Picture plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.5.4 via the wpuaactionprocessoptionupdate function. This is due to insufficient file type validation in wphandleupload called without a MIME...

PT-2021-16186

Name of the Vulnerable Software and Affected Versions The One User Avatar WordPress plugin versions prior to 2.3.7 Description The issue concerns a lack of CSRF check when updating the avatar in a page where the avatar upload shortcode is embedded. This allows attackers to make logged-in users...