What’s Vulnerable › Products

User Profile Picture vulnerabilities

4 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 1 published in the last 12 months.

Check whether your User Profile Picture version is affected

Latest User Profile Picture vulnerabilities

• CVE-2026-61971 — WordPress User Profile Picture plugin <= 2.6.3 - Insecure Direct Object References (IDOR) vulnerability (CVSS 2.7)
• CVE-2024-5639 — User Profile Picture <= 2.6.1 - Authenticated (Author+) Insecure Direct Object Reference to Profile Picture Update (CVSS 4.3)
• CVE-2021-24473 — User Profile Picture < 2.6.0 - Arbitrary User Picture Change/Deletion via IDOR (CVSS 5.4)
• CVE-2021-24170 — User Profile Picture < 2.5.0 - Sensitive Information Disclosure (CVSS 7.5)