Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: onedesigns Clear all filters
TI-2026-15513 CVE-2026-18983 · GHSA-p2qh-mgvf-5q7f

Unrestricted file upload in onedesigns One User Avatar | User Profile Picture

Priority LOW 36

The One User Avatar | User Profile Picture plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.5.4 via the wpua_action_process_option_update function.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00872 Published 2026-08-28 No fix listed CWE-434
TI-2021-06957 CVE-2021-24675 · GHSA-jwxc-3mv8-gfrr

One User Avatar < 2.3.7 - Avatar Update via CSRF

Priority LOW 30

The One User Avatar WordPress plugin before 2.3.7 does not check for CSRF when updating the Avatar in page where the [avatar_upload] shortcode is embed.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00572 Published 2021-10-18 Fixed in 2.3.7 CWE-352
TI-2021-06954 CVE-2021-24672 · GHSA-4f2g-r3q6-6v29

One User Avatar < 2.3.7 - Contributor+ Stored Cross-Site Scripting

Priority LOW 25

The One User Avatar WordPress plugin before 2.3.7 does not escape the link and target attributes of its shortcode, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0065 Published 2021-10-18 Fixed in 2.3.7 CWE-79