Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: One User Avatar | User Profile Picture 2.3.7 Clear all filters
TI-2021-06957 CVE-2021-24675 · GHSA-jwxc-3mv8-gfrr

One User Avatar < 2.3.7 - Avatar Update via CSRF

Priority LOW 30

The One User Avatar WordPress plugin before 2.3.7 does not check for CSRF when updating the Avatar in page where the [avatar_upload] shortcode is embed.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00572 Published 2021-10-18 Fixed in 2.3.7 CWE-352
TI-2021-06954 CVE-2021-24672 · GHSA-4f2g-r3q6-6v29

One User Avatar < 2.3.7 - Contributor+ Stored Cross-Site Scripting

Priority LOW 25

The One User Avatar WordPress plugin before 2.3.7 does not escape the link and target attributes of its shortcode, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0065 Published 2021-10-18 Fixed in 2.3.7 CWE-79