The One User Avatar | User Profile Picture WordPress plugin contains a stored Cross‑Site Scripting flaw that is triggered by uploading a file through the wpua_action_process_option_update function. The plugin performs insufficient file type validation: it calls wp_handle_upload() without a MIME‑type allow‑list, then relies on the client‑supplied Content‑Type header for post‑write checks, and never removes files that fail the check. This allows an attacker with subscriber‑level access to upload a specially crafted file that the server treats as executable. The flaw can be abused to execute arbitrary code on the server and therefore results in remote code execution.

The vulnerability affects the One User Avatar | User Profile Picture plugin for WordPress released by onedesigns. All plugin versions up to and including 2.5.4 are vulnerable. Users of the plugin on any WordPress installation that has not upgraded beyond 2.5.4 are at risk.

The CVSS score is 7.5, indicating a high likelihood of serious impact. EPSS data is not available, but the flaw is listed as not KEV. Exploitation requires an authenticated user with at least subscriber privileges who is allowed to upload avatars; the attacker must upload a file that bypasses the plugin’s checks (e.g., a .dxfp file). Once uploaded, the file can be executed by the webserver, giving the attacker full control over the site. Attackers could then inject malicious scripts that affect other users or steal data. The risk of exploitation is considered high given the authentication requirement is commonly met on multi‑role WordPress sites.