Skip to content
Sign in
Not rated

CVE-2021-24675 The One User Avatar WordPress plugin before 2.3.7 does not check for CSRF when updating the Avatar in page where the…

Description

The One User Avatar WordPress plugin before 2.3.7 does not check for CSRF when updating the Avatar in page where the [avatar_upload] shortcode is embed. As a result, attackers could make logged in user change their avatar via a CSRF attack

Affected products and versions

Product Affected versions Fixed in
One User Avatar | User Profile Picture 2.3 earliest → < 2.3.7 2.3.7

Other CVEs of One User Avatar | User Profile Picture

The 2 CVEs of One User Avatar | User Profile Picture →
CVE-2021-24672 The One User Avatar WordPress plugin before 2.3.7 does not escape the link and target attributes of its shortcode,… Not rated
Track this CVE