WP Social Avatar

WP Social Avatar has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it remains unpatched as of August 2026. Their average CVSS score is 5.3, and the most serious one scores 5.3 out of 10.

The most common weakness is Missing Authorization, behind 1 of the records (100%).

The one issue recorded for WP Social Avatar has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2026.

All of these findings were reported by Muqsith Barru. WP Social Avatar is installed on roughly 200 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 4.5.33.

Strategic Overview

Avg CVSSMedium
5.3/ 10
Patch Coverage0%
Open

1

Fixed

0

Get automatic notifications for all WP Social Avatar vulnerabilities before they are exploited.

Most severe open issueCVSS 5.3CVE-2026-66454

WP Social Avatar <= 1.5 - Missing Authorization

Read the full analysis

Vulnerability Records

1 records
Showing 1–1 of 1 reports
WP Social Avatar banner
Latestv1.5

WP Social Avatar

Maruti Mohanty

Author

Maruti Mohanty

4.3(6)
86/100
Last Updated
2016-06-21 (10y ago)
Active Installs
200+
Downloads
18,386
Requires WP
3.3.1+
Requires PHP
0+
Tested up to
WP 4.5.33
Created
2014-02-26 (13y ago)

As the name suggests, this plugin allows you to use the social profile picture as your WordPress Avatar. You can see more, on how to install and use the plugin here in this blog WP Social Avatar Why this plugin? If you are me, who gets bore of using the same gravatar for few days or months then this plugin is totally for you. This plugin provides option to the user to use Social media like Facebook and Google plus profile pictures as the gravatar instead of the one from en.gravatar.com. WP Social Avatar Settings: After activating the plugin admin will see WP Avatar, under Users menu. Here the admin can set the minimum role/capabilities required to avail this feature. The allowed users will see the available options in their Your Profile sub menu under Users menu. For the first version I only have two social options available, Facebook and Google plus. You need to add either the Facebook user ID(numeric) or Google plus id in the corresponding fields. You can find your facebook user id here Once done with the above, check the social profile picture you want to use as the gravatar and click Update Profile and you are done. After saving the profile you can see all the gravatars in the site has been replaced by the respective social media profile picture. With this you will get rid of the boredom of looking at the same gravatar all the time. With the change in the respective social media profile picture, the gravatar of your site will also change. With Version 1.4 Cache functionality is implemented for Google Plus avatar, this optimizes the functionality. I have added a clear cache button for Google plus, anytime you upload a new profile picture in your Google Plus account click the “clear cache” button and you will get the latest image else the code will make a request and pull the latest image after every 48 hours. This has been done to make the Google Plus functionality faster.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C