onedesigns vulnerabilities

Products

• one user avatar 2
• cover wp 1
• One User Avatar | User Profile Picture 1

Latest onedesigns CVEs

Newest publication first

1. CVE-2026-18983 One User Avatar | User Profile Picture <= 2.5.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wpua-file Parameter

   Published 2026-08-28

   High·CVSS 7.5 EPSS 0.87%

   The One User Avatar | User Profile Picture plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.5.4 via the wpua_action_process_option_update function. This is due to insufficient file type validation in wp_handle_upload() call...

2. CVE-2021-24675 One User Avatar < 2.3.7 - Avatar Update via CSRF

   Published 2021-10-18

   Medium·CVSS 6.5 EPSS 0.57%

   The One User Avatar WordPress plugin before 2.3.7 does not check for CSRF when updating the Avatar in page where the [avatar_upload] shortcode is embed. As a result, attackers could make logged in user change their avatar via a CSRF attack

3. CVE-2021-24672 One User Avatar < 2.3.7 - Contributor+ Stored Cross-Site Scripting

   Published 2021-10-18

   Medium·CVSS 5.4 EPSS 0.65%

   The One User Avatar WordPress plugin before 2.3.7 does not escape the link and target attributes of its shortcode, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks

4. CVE-2011-3860 Cover WP <= 1.6.5 - Cross-Site Scripting

   Published 2011-09-28

   Medium·CVSS 4.3 EPSS 3.5% Public exploit

   Cross-site scripting (XSS) vulnerability in the Cover WP theme before 1.6.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.