Threat Entry Updated 2025-01-16

CVE-2024-10789 - Wp User Profile Avatar Plugin

The WP User Profile Avatar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.5. This is due to missing or incorrect nonce validation on the wpupa_user_admin() function. This makes it possible for unauthenticated attackers to update the plugins setting which controls access to the functionality via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

PLUGIN Wp User Profile Avatar

CVE-2024-10789

MEDIUM CVSS 4.3 2025-01-16

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-05-09

CVE-2023-6067 - Wp User Profile Avatar Plugin

The WP User Profile Avatar WordPress plugin through 1.0.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

PLUGIN Wp User Profile Avatar

CVE-2023-6067

MEDIUM CVSS 5.4 2024-04-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-06-11

CVE-2023-6384 - Wp User Profile Avatar Plugin

The WP User Profile Avatar WordPress plugin before 1.0.1 does not properly check for authorisation, allowing authors to delete and update arbitrary avatar

PLUGIN Wp User Profile Avatar

CVE-2023-6384

MEDIUM CVSS 4.3 2024-01-22

Risk Score

Open Full Technical Breakdown