WP User Profile Avatar

WP User Profile Avatar has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2025; 4 are fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 5.3, and the most serious one scores 6.4 out of 10. 2025 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 2 of the records (40%). Other recurring categories include Authorization Bypass Through User-Controlled Key, Cross-Site Request Forgery (CSRF).

4 of the records (80%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2025.

4 independent researchers contributed these findings, most of them (2) reported by Dmitrii Ignatyev.

Strategic Overview

Avg CVSSMedium

5.3/ 10

Patch Coverage80%

Open

Fixed

Get automatic notifications for all WP User Profile Avatar vulnerabilities before they are exploited.

Most severe open issueCVSS 4.3CVE-2025-49980

WP User Profile Avatar <= 1.0.6 - Missing Authorization

Read the full analysis

Vulnerability Records

5 records


2025-06-19 00:00	WP User Profile Avatar <= 1.0.6 - Missing Authorization WP User Profile Avatar <= 1.0.6	`CVE-2025-49980`	4.3 Medium	s1lentmt	No
2025-01-15 15:23	WP User Profile Avatar <= 1.0.5 - Cross-Site Request Forgery to Settings Update WP User Profile Avatar <= 1.0.5	`CVE-2024-10789`	4.3 Medium	Muhammad Yudha - DJ	Yes
2024-03-25 00:00	WP User Profile Avatar <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode WP User Profile Avatar <= 1.0.1	`CVE-2023-6067`	6.4 Medium	Dmitrii Ignatyev	Yes
2023-12-29 00:00	WP User Profile Avatar <= 1.0.0 - Authenticated (Author+) Insecure Direct Object Reference to Avatar Deletion/Update WP User Profile Avatar <= 1.0.0	`CVE-2023-6384`	5.3 Medium	Dmitrii Ignatyev	Yes
2023-12-28 00:00	WP User Profile Avatar <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting WP User Profile Avatar <= 1.0	`CVE-2023-52118`	6.4 Medium	Abu Hurayra (HurayraIIT)	Yes

Showing 1–5 of 5 reports