Vulnerabilities / WP User Avatars
WP User Avatars vulnerabilities
Advisories WPSec published for WP User Avatars. Other sources may list more. Its attack surface: WP User Avatars on WPSec AttackSurface.
| Published | ID | Vulnerability | Severity | Fixed in |
|---|---|---|---|---|
| 2026-10-01 | WPSEC-2026-0120 | WP User Avatars <= 1.4.1 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Attachment Assignment via assign_wp_user_avatars_media AJAX Action | Medium 4.3 | 2.0.0 |
License: CC BY 4.0