CVE · Medium
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2021-24672 | One User Avatar | User Profile Picture [one-user-avatar] < 2.3.7 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 2.3.7 | 2.3.7 | 2021-09-20 | — |
The One User Avatar plugin versions before 2.3.7 fails to properly sanitize the link and target attributes within its shortcode functionality, which enables users with Contributor-level permissions or higher to inject and store malicious scripts that execute in the browsers of site visitors.
Based on public CVE data (MITRE/NVD).
No signup, no credit card — enter your URL and get a security report in seconds.