Read the docs

onedesigns

Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

onedesigns records in CISA KEV

No onedesigns vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
One User Avatar 2 records LOW Cover Wp 1 record LOW

Records

4 records

TI-2026-15513 CVE-2026-18983 · GHSA-p2qh-mgvf-5q7f

Unrestricted file upload in onedesigns One User Avatar | User Profile Picture

Priority LOW 36

The One User Avatar | User Profile Picture plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.5.4 via the wpua_action_process_option_update function.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00872 Published 2026-08-28 No fix listed CWE-434
TI-2021-06957 CVE-2021-24675 · GHSA-jwxc-3mv8-gfrr

One User Avatar < 2.3.7 - Avatar Update via CSRF

Priority LOW 30

The One User Avatar WordPress plugin before 2.3.7 does not check for CSRF when updating the Avatar in page where the [avatar_upload] shortcode is embed.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00572 Published 2021-10-18 Fixed in 2.3.7 CWE-352
TI-2021-06954 CVE-2021-24672 · GHSA-4f2g-r3q6-6v29

One User Avatar < 2.3.7 - Contributor+ Stored Cross-Site Scripting

Priority LOW 25

The One User Avatar WordPress plugin before 2.3.7 does not escape the link and target attributes of its shortcode, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0065 Published 2021-10-18 Fixed in 2.3.7 CWE-79
Open these records in search →