Author Avatars List/Block
Author Avatars List/Block has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; 3 are fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 3 of the records (75%). Other recurring categories include Missing Authorization.
3 of the records (75%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.
4 independent researchers contributed these findings, one record each. Author Avatars List/Block is installed on roughly 4,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.0.
CVE-2026-39690Author Avatars List/Block <= 2.1.25 - Missing Authorization
Read the full analysisVulnerability Records
Author Avatars List/Block
Author
Paul Bearne
This plugin makes it easy to display lists of user avatars, grouped by user roles, on your (multiuser) site. It also allows you to insert single avatars for blog users or any email address into a post or page – great for displaying an image of someone you’re talking about. It makes use of built-in WordPress (core) functions to retrieve user information and get avatars. Integrates with: Gutenberg, BuddyPress, xprofile, Multisite, Wpmu, BBPress, co-authors. Avatar lists can be inserted into your sidebar by adding a widget or into posts/pages by using a shortcode. The plugin comes with a tinymce editor plugin which makes inserting shortcodes very easy. This also provides Gutenberg Block for use with the Gutenberg editor. Please help with the plugin Translations at https://translate.wordpress.org/projects/wp-plugins/author-avatars. Both the shortcode and widget and Gutenberg Block can be configured to: Show a custom title (widget only) Only show specific user groups and/or hide certain users Limit the number of users shown Change the sort order of users or show in random order Adjust the size of user avatars Optionally show a user’s name or biography Show users from the current blog, all blogs or a selection of blogs (on WPMU/Multisite) Group users by their blog (when showing from multiple blogs), and show the blog name above each grouping. Support users from Co-Author Plus, Ultimate Member, BBpress and BuddyPress (xprofile) Limit the number of avatars per page for large sets by adding a page_size to the shortcode e.g. “page_size=30” (shortcode only) Additionally, single user avatars can be inserted using the show_avatar shortcode and configured to: Adjust the size of the user avatar. Align the avatar left, centered or right. The Gutenberg Block support both single user avatars and role based selections of avatars Please report bugs and provide feedback in the wordpress support forum. Plugin support: In 2011, Ben stepped down as maintainer of the Plugin, handing over ownership to co-author Paul Bearne, who continues to provide support and drive the development of new features.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C