One User Avatar Security Vulnerabilities and Issues — One User Avatar CVE List

Lucene search

OnedesignsOne User Avatar

3 matches found

CVE•added 2021/10/18 2:15 p.m.•41 views

CVE-2021-24675

The One User Avatar WordPress plugin before 2.3.7 does not check for CSRF when updating the Avatar in page where the [avatar_upload] shortcode is embed. As a result, attackers could make logged in user change their avatar via a CSRF attack

6.5CVSS6.4AI score0.00103EPSS

CVE•added 2021/10/18 2:15 p.m.•37 views

CVE-2021-24672

The One User Avatar WordPress plugin before 2.3.7 does not escape the link and target attributes of its shortcode, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks

5.4CVSS5.3AI score0.0018EPSS

CVE•added 2023/10/16 8:15 p.m.•36 views

CVE-2023-4798

The User Avatar WordPress plugin before 1.2.2 does not properly sanitize and escape certain of its shortcodes attributes, which could allow relatively low-privileged users like contributors to conduct Stored XSS attacks.

5.4CVSS5.6AI score0.00103EPSS