Skip to content
Sign in
Not rated

CVE-2021-24672 The One User Avatar WordPress plugin before 2.3.7 does not escape the link and target attributes of its shortcode,…

Description

The One User Avatar WordPress plugin before 2.3.7 does not escape the link and target attributes of its shortcode, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks

Affected products and versions

Product Affected versions Fixed in
One User Avatar | User Profile Picture 2.3 earliest → < 2.3.7 2.3.7

Other CVEs of One User Avatar | User Profile Picture

The 2 CVEs of One User Avatar | User Profile Picture →
CVE-2021-24675 The One User Avatar WordPress plugin before 2.3.7 does not check for CSRF when updating the Avatar in page where the… Not rated
Track this CVE