CVE-2025-49980: Wp Event Manager Wp User Profile Avatar

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Missing Authorization vulnerability in WP Event Manager WP User Profile Avatar wp-user-profile-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Profile Avatar: from n/a through <= 1.0.6.

Affected products

• Wp Event Manager Wp User Profile Avatar: up to and including 1.0.6

Published 2025-06-20. Last modified 2026-06-17.