Read the docs

onedesigns

Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

onedesigns records in CISA KEV

No onedesigns vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
One User Avatar 2 records LOW Cover Wp 1 record LOW

Records

2 records in One User Avatar · all components

TI-2021-06957 CVE-2021-24675 · GHSA-jwxc-3mv8-gfrr

One User Avatar < 2.3.7 - Avatar Update via CSRF

Priority LOW 30

The One User Avatar WordPress plugin before 2.3.7 does not check for CSRF when updating the Avatar in page where the [avatar_upload] shortcode is embed.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00572 Published 2021-10-18 Fixed in 2.3.7 CWE-352
TI-2021-06954 CVE-2021-24672 · GHSA-4f2g-r3q6-6v29

One User Avatar < 2.3.7 - Contributor+ Stored Cross-Site Scripting

Priority LOW 25

The One User Avatar WordPress plugin before 2.3.7 does not escape the link and target attributes of its shortcode, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0065 Published 2021-10-18 Fixed in 2.3.7 CWE-79
Open these records in search →