CVE-2021-24675

CVE-2021-24675 concerns the WordPress plugin “One User Avatar” (before 2.3.7). The vulnerability arises because the plugin does not verify CSRF when updating the avatar via the [avatar_upload] shortcode, allowing a logged-in attacker to induce a CSRF attack that changes a user’s avatar. Affected ...

CVE-2021-24672

The CVE-2021-24672 entry concerns the WordPress plugin One User Avatar (versions prior to 2.3.7). The vulnerability arises from failure to esc ape the link and target attributes in the plugin’s shortcode, enabling a user with as little as a Contributor role to perform a Stored Cross-Site Scriptin...