TI-2025-03092 CVE-2025-3520 · GHSA-m9p6-4vvj-3w8mAvatar <= 0.1.4 - Authenticated (Subscriber+) Arbitrary File DeletionPriority LOW 37The Avatar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in a function in all versions up to, and including, 0.1.4.CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.01025 · Published 2025-04-18 · No fix listed CWE-22