Skip to content
OpenAdvisories

Product · WP Event Manager

WP User Profile Avatar

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 4.3
    CVE-2025-49980

    WordPress WP User Profile Avatar plugin <= 1.0.6 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in WP Event Manager WP User Profile Avatar wp-user-profile-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Profile Avatar: from n/a through <= 1.0.6.

    WP Event Manager WP User Profile Avatar
  • Medium 4.3
    CVE-2024-10789

    WP User Profile Avatar <= 1.0.5 - Cross-Site Request Forgery to Settings Update

    The WP User Profile Avatar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.5. This is due to missing or incorrect nonce validation on the wpupa_user_admin() function. This makes it possible for unauth…

    WP Event Manager WP User Profile Avatar Web / CMS
  • Medium 6.5
    CVE-2023-52118

    WordPress WP User Profile Avatar Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Event Manager WP User Profile Avatar allows Stored XSS.This issue affects WP User Profile Avatar: from n/a through 1.0.

    WP Event Manager WP User Profile Avatar