CVE-2024-5639 User Profile Picture <= 2.6.1 - Authenticated (Author+) Insecure Direct Object Reference to Profile Picture Update

The User Profile Picture plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.6.1 via the 'restapichangeprofileimage' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

WordPress User profile Plugin <= 2.0.20 is vulnerable to Cross Site Scripting (XSS)

Software User profile Type Plugin Vulnerable versions = 2.0.20 Fixed in 2.0.21 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-29097 Patch priority Medium CVSS severity Medium 6.3 Developer Claim ownership PSID 53c17e5b3988 Credits Kang SeoHee Required privilege...