WordPress plugin
Simple Local Avatars security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 6 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High1
- Medium4
- Low1
All Simple Local Avatars vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium4.3 | Missing Authorization to Authenticated (Subscriber+) Avatar Migration ≤2.8.4Update to 2.8.5 | CVE-2025-8482 | |
| Medium4.3 | Missing Authorization to Authenticated (Subscriber+) User Cache Clearing ≤2.7.11Update to 2.8.0 | CVE-2024-10786 | |
| Medium4.3 | Cross-Site Request Forgery via save_default_avatar_file_id() ≤2.7.10Update to 2.7.11 | CVE-2024-43116 | |
| High8.1 | Remote Code Execution ≤1.1.0Update to 1.1.1 | CVE-2022-25860 | |
| Medium5.3 | Regular Expression Denial of Service (ReDoS) ≤2.7.3Update to 2.7.4 | CVE-2022-25881 | |
| Low3.7 | Denial of Service ≤4.2.2Update to 4.3.0 | CVE-2022-25858 |
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Avatar Migration
≤2.8.4Update to 2.8.5
- Medium4.3Missing Authorization to Authenticated (Subscriber+) User Cache Clearing
≤2.7.11Update to 2.8.0
- Medium4.3Cross-Site Request Forgery via save_default_avatar_file_id()
≤2.7.10Update to 2.7.11
- High8.1Remote Code Execution
≤1.1.0Update to 1.1.1
- Medium5.3Regular Expression Denial of Service (ReDoS)
≤2.7.3Update to 2.7.4
- Low3.7Denial of Service
≤4.2.2Update to 4.3.0
Simple Local Avatars: common questions
Does Simple Local Avatars have known vulnerabilities?
Yes. VulnCrest Radar lists 6 known vulnerabilities in Simple Local Avatars: 1 high, 4 medium, 1 low. None are known to affect version null.
How do I check which version of Simple Local Avatars I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Simple Local Avatars vulnerability?
CVE-2025-8482, published Aug 11, 2025: Simple Local Avatars <= 2.8.4 - Missing Authorization to Authenticated (Subscriber+) Avatar Migration. Severity: Medium (CVSS 4.3).
Is any Simple Local Avatars vulnerability listed in CISA KEV?
No. None of the known Simple Local Avatars vulnerabilities is currently listed in the CISA KEV catalog.