One User Avatar | User Profile Picture
Healthy: vulnerability published 27 Aug 2026, fixed in 2.5.5.
| Ownership | 100 |
|---|---|
| Maintenance | 100 |
| Security | 90 |
| Support | 70 |
| Reputation | 70 |
Active signals
Facts we detected, with links to the source.
- WarningSEC-1Vulnerability published 27 Aug 2026, fixed in 2.5.5. Update to version 2.5.5 or later.27 Aug 2026Evidence
Ownership timeline
Who commits to the plugin's code on wordpress.org, over time.
| plugin-master | 25 May 2021 to 25 May 2021, 1 commits |
|---|---|
| onedesigns | 25 May 2021 to 21 Aug 2026, 25 commits |
2 committers recorded. No ownership changes recorded since 3 Nov 2026.
Maintenance
- Last release
- 2 months ago
- Releases, 24 months
- 5
- Tested up to
- 7.1 current
- Requires PHP
- not stated supported 8.2+
| Q1 2024 | 0 |
|---|---|
| Q2 2024 | 0 |
| Q3 2024 | 0 |
| Q4 2024 | 1 |
| Q1 2025 | 0 |
| Q2 2025 | 0 |
| Q3 2025 | 0 |
| Q4 2025 | 0 |
| Q1 2026 | 3 |
| Q2 2026 | 0 |
| Q3 2026 | 2 |
| Q4 2026 | 0 |
Last release 21 Aug 2026. Tested with WordPress 7.1 (current).
Support
0% of 1 support threads resolved in the last 2 months.
Security record
| Published | Issue | CVSS | Affected | Fixed in | Days to patch |
|---|---|---|---|---|---|
| 27 Aug 2026 | One User Avatar | User Profile Picture <= 2.5.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wpua-file Parameter | 7.5 | <= 2.5.4 | 2.5.5 | 0 |
| 20 Sep 2021 | One User Avatar <= 2.3.6 - Cross-Site Request Forgery | 6.5 | < 2.3.7 | 2.3.7 | 0 |
| 20 Sep 2021 | One User Avatar <= 2.3.6 - Stored Cross-Site Scripting | 5.4 | < 2.3.7 | 2.3.7 | 0 |
Source: Wordfence Intelligence.
Reputation
Average rating fell from 5.0 to 2.0 between Q4 2023 and Q3 2024.
| 5 star | 37 |
|---|---|
| 4 star | 1 |
| 3 star | 0 |
| 2 star | 2 |
| 1 star | 1 |
- Slows down site · 2 stars · 1 Jul 2024
- Great plugin, BUT… hideous icon. · 2 stars · 22 Mar 2023
- Just doesn’t work for me · 1 star · 9 Feb 2022
Momentum
100,000+ active installs. History builds with each weekly snapshot.
| 4 May 2026 | 1,002 |
|---|---|
| 11 May 2026 | 2,255 |
| 18 May 2026 | 2,075 |
| 25 May 2026 | 2,006 |
| 1 Jun 2026 | 1,912 |
| 8 Jun 2026 | 1,934 |
| 15 Jun 2026 | 1,977 |
| 22 Jun 2026 | 1,654 |
| 29 Jun 2026 | 1,541 |
| 6 Jul 2026 | 1,612 |
| 13 Jul 2026 | 1,674 |
| 20 Jul 2026 | 1,900 |
| 27 Jul 2026 | 1,778 |
| 3 Aug 2026 | 1,653 |
| 10 Aug 2026 | 1,954 |
| 17 Aug 2026 | 25,614 |
| 24 Aug 2026 | 12,743 |
| 31 Aug 2026 | 7,524 |
| 7 Sep 2026 | 4,295 |
| 14 Sep 2026 | 6,064 |
| 21 Sep 2026 | 4,670 |
| 28 Sep 2026 | 3,660 |
| 5 Oct 2026 | 3,764 |
| 12 Oct 2026 | 2,857 |
| 19 Oct 2026 | 4,235 |
| 26 Oct 2026 | 3,575 |
| 2 Nov 2026 | 518 |
Weekly downloads over the last 4 weeks are 29% below the 27-week average.
Healthier alternatives
Same category, higher Canary Score. Never sponsored.
Facts
| Version | 2.5.6 |
|---|---|
| Author | One Designs |
| Added | 25 May 2021 |
| Last updated | 21 Aug 2026 |
| Active installs | 100,000+ |
| Requires WordPress | 4.0 |
| Tested up to | 7.1.4 |
| Requires PHP | not stated |
| Category | User Management & Authentication > User Registration & Login |
| Tags | users, avatar, bbPress, profile, gravatar |
Questions
Is One User Avatar | User Profile Picture still maintained?
One User Avatar | User Profile Picture was last updated on 21 Aug 2026. Its Canary status is Healthy.
Is One User Avatar | User Profile Picture safe?
One User Avatar | User Profile Picture has no open unpatched vulnerabilities on record. 1 vulnerability was published in the last 24 months. Its Canary status is Healthy.
Who owns One User Avatar | User Profile Picture?
The wordpress.org author is One Designs. Recent committers: onedesigns, plugin-master. We have recorded no ownership change.
What can I use instead of One User Avatar | User Profile Picture?
Plugins in the same category with a higher Canary Score: LoginWP (Formerly Peter's Login Redirect), Gravatar Enhanced - Avatars, Profiles, and Privacy, WP User Avatars, Sidebar Login, WP Login Form.