Skip to content
OpenAdvisories

Vendor

onedesigns

1 known vulnerabilities.

Products

One User Avatar | User Profile Picture 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.5
    CVE-2026-18983

    One User Avatar | User Profile Picture <= 2.5.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wpua-file Parameter

    The One User Avatar | User Profile Picture plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.5.4 via the wpua_action_process_option_update function. This is due to insufficient file type validation in wp…

    onedesigns One User Avatar | User Profile Picture Web / CMS