User Profile Picture vulnerabilities | LiveThreat CVE Feed — Verisq

Login Request a demo

UP

Product

User Profile Picture

by Cozmoslabs · last CVE Jul 13, 2026

4

CVEs

0

On KEV

7.5

Max CVSS

0

New 30D

Vulnerabilities4 In the news0 Timeline

Severity mix

Critical 0High 1Medium 2Low 1

Severity

All severities4 Critical0 High1 Medium2 Low1

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add User Profile Picture to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2021-24170	7.5	6%	Apr 5	The REST API endpoint get_users in the User Profile Picture WordPress plugin before 2.5.0 returned more information than was required for its functionality to users with the… Affected: before 2.5.0
CVE-2021-24473	5.4	1%	Aug 2	The User Profile Picture WordPress plugin before 2.6.0 was affected by an IDOR issue, allowing users with the upload_image capability (by default author and above) to change and… Affected: before 2.6.0
CVE-2024-5639	4.3	0%	Jun 21	The User Profile Picture plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.6.1 via the 'rest_api_change_profile_image'… Affected: before 2.6.2
CVE-2026-61971	2.7	0%	Jul 13	WordPress User Profile Picture plugin <= 2.6.3 - Insecure Direct Object References (IDOR) vulnerability Affected: through 2.6.3