Onedesigns
Monthly
Remote code execution via unrestricted file upload in the One User Avatar WordPress plugin (all versions ≤ 2.5.4) is enabled by a flawed avatar upload handler that accepts DXFP files - bypassing only PHP and SVG blocks - while trusting the attacker-controlled client-supplied Content-Type header instead of a server-derived MIME type, and retaining uploaded files that fail post-write validation. Exploitation requires subscriber-level WordPress credentials and a non-default administrative decision to grant subscribers avatar upload capability. No public exploit has been identified at time of analysis; no EPSS data was provided.
The One User Avatar WordPress plugin before 2.3.7 does not check for CSRF when updating the Avatar in page where the [avatar_upload] shortcode is embed. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The One User Avatar WordPress plugin before 2.3.7 does not escape the link and target attributes of its shortcode, allowing users with a role as low as Contributor to perform Stored Cross-Site. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Remote code execution via unrestricted file upload in the One User Avatar WordPress plugin (all versions ≤ 2.5.4) is enabled by a flawed avatar upload handler that accepts DXFP files - bypassing only PHP and SVG blocks - while trusting the attacker-controlled client-supplied Content-Type header instead of a server-derived MIME type, and retaining uploaded files that fail post-write validation. Exploitation requires subscriber-level WordPress credentials and a non-default administrative decision to grant subscribers avatar upload capability. No public exploit has been identified at time of analysis; no EPSS data was provided.
The One User Avatar WordPress plugin before 2.3.7 does not check for CSRF when updating the Avatar in page where the [avatar_upload] shortcode is embed. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The One User Avatar WordPress plugin before 2.3.7 does not escape the link and target attributes of its shortcode, allowing users with a role as low as Contributor to perform Stored Cross-Site. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.