Login Request a demo
UP
Product
User Profile Picture
by cozmoslabs · last CVE Jul 13, 2026
4
CVEs
0
On KEV
7.5
Max CVSS
0
New 30D
Vulnerabilities4In the news0Timeline
Severity mix
Critical 0High 1Medium 2Low 1
Severity
All severities4Critical0High1Medium2Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add User Profile Picture to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2021-24170
7.5
6%
Apr 5
The REST API endpoint get_users in the User Profile Picture WordPress plugin before 2.5.0 returned more information than was required for its functionality to users with the…
Affected: before 2.5.0
CVE-2021-24473
5.4
1%
Aug 2
The User Profile Picture WordPress plugin before 2.6.0 was affected by an IDOR issue, allowing users with the upload_image capability (by default author and above) to change and…
Affected: before 2.6.0
CVE-2024-5639
4.3
0%
Jun 21
User Profile Picture <= 2.6.1 - Authenticated (Author+) Insecure Direct Object Reference to Profile Picture Update
Affected: through 2.6.1
CVE-2026-61971
2.7
0%
Jul 13
WordPress User Profile Picture plugin <= 2.6.3 - Insecure Direct Object References (IDOR) vulnerability
Affected: through 2.6.3
Showing 4