Simple Local Avatars

Simple Local Avatars has 6 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2025; all 6 are fixed as of September 2026. Their average CVSS score is 5.0, and the most serious one scores 8.1 out of 10. Severity breakdown: 0 critical and 1 high. 2024 was the busiest year with 2 disclosures.

The most common weakness is Missing Authorization, behind 2 of the records (33%). Other recurring categories include Code Injection, Cross-Site Request Forgery (CSRF).

Every one of the 6 issues recorded for Simple Local Avatars has a vendor fix available, so running the current release closes all known holes.

3 independent researchers contributed these findings, one record each. Simple Local Avatars is installed on roughly 100,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium

5.0/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Simple Local Avatars vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.1CVE-2022-25860

simple-git < 3.16.0 - Remote Code Execution

Read the full analysis

Vulnerability Records

6 records


2025-08-11 18:20	Simple Local Avatars <= 2.8.4 - Missing Authorization to Authenticated (Subscriber+) Avatar Migration Simple Local Avatars <= 2.8.4	`CVE-2025-8482`	4.3 Medium	Håkon Harnes	Yes
2024-11-15 00:00	Simple Local Avatars <= 2.7.11 - Missing Authorization to Authenticated (Subscriber+) User Cache Clearing Simple Local Avatars <= 2.7.11	`CVE-2024-10786`	4.3 Medium	Trương Hữu Phúc (truonghuuphuc)	Yes
2024-08-07 00:00	Simple Local Avatars <= 2.7.10 - Cross-Site Request Forgery via save_default_avatar_file_id() Simple Local Avatars <= 2.7.10	`CVE-2024-43116`	4.3 Medium	Rafie Muhammad	Yes
2023-02-23 00:00	simple-git < 3.16.0 - Remote Code Execution Simple Local Avatars <= 2.7.3	`CVE-2022-25860`	8.1 High	Anonymous	Yes
2023-02-23 00:00	http-cache-semantics < 4.1.1 - Regular Expression Denial of Service (ReDoS) Simple Local Avatars <= 2.7.3	`CVE-2022-25881`	5.3 Medium	Anonymous	Yes
2022-07-14 00:00	terser (JS Package) < 5.14.2 - Denial of Service Simple Local Avatars <= 2.5.0	`CVE-2022-25858`	3.7 Low	Anonymous	Yes

Showing 1–6 of 6 reports

Latestv2.8.6

Simple Local Avatars

Author

10up

4.6(89)

92/100

Last Updated

2026-08-19 (24d ago)

Active Installs

100,000+

Downloads

2,535,253

Requires WP

6.6+

Requires PHP

7.4+

Tested up to

WP 7.1

Created

2011-01-17 (16y ago)

Adds an avatar upload field to user profiles if the current user has media permissions. Generates requested sizes on demand just like Gravatar! Simple and lightweight. Just edit a user profile, and scroll down to the new “Avatar” field. The plug-in will take care of cropping and sizing! Stores avatars in the “uploads” folder where all of your other media is kept. Has a simple, native interface. Fully supports Gravatar and default avatars if no local avatar is set for the user – but also allows you turn off Gravatar. Generates the requested avatar size on demand (and stores the new size for efficiency), so it looks great, just like Gravatar! Lets you decide whether lower privilege users (subscribers, contributors) can upload their own avatar. Enables rating of local avatars, just like Gravatar. Support Level Simple Local Avatars’ support level is marked as stable. 10up is not planning to develop any new features for this, but will still respond to bug reports and security concerns. We welcome PRs, but any that include new features should be small and easy to integrate and should not include breaking changes. We otherwise intend to keep this tested up to the most recent version of WordPress.

View on WordPress.org