User Profile Picture
Avoid: vulnerability published 28 Jun 2021 still has no fix after 14 days.
Based on 3 of 5 areas
Capped at 39: a vulnerability has no patch.
| Ownership | 100 |
|---|---|
| Maintenance | 100 |
| Security | 40 |
| Support | No data |
| Reputation | No data |
Active signals
Open issues right now, with links to the source.
- CriticalSEC-2Vulnerability published 28 Jun 2021 still has no fix after 14 days. Disable or replace the plugin. No fix has been released.12 Jul 2021Evidence
History: 1 past vulnerability, 1 still unpatched in the current version. Patched issues are listed in the Security record, not here.
Quick answers
- Is User Profile Picture still maintained?
- Yes. Last release 24 Oct 2026, 6 releases in the last 24 months. 24 Oct 2026 · wordpress.org
- Who owns User Profile Picture, and has it changed hands?
- No change recorded. Main committer dewtechnolab since Sep 2019. 3 Nov 2026 · SVN log
- Was User Profile Picture removed from wordpress.org?
- No. Listed on wordpress.org as of 3 Nov 2026. 3 Nov 2026 · wordpress.org
- Is User Profile Picture safe?
- No. 1 known vulnerability has no fix in the current version. 28 Jun 2021 · Wordfence Intelligence
- Is the latest User Profile Picture update safe to install?
- No ownership change before 1.0.10. No one-star spike after it. 24 Oct 2026 · Release history
Ownership timeline
Who commits to the plugin's code on wordpress.org, over time.
| plugin-master | 23 Sep 2019 to 23 Sep 2019, 1 commits |
|---|---|
| dewtechnolab | 24 Sep 2019 to 24 Oct 2026, 14 commits |
2 committers recorded. No ownership changes recorded since 2019.
Maintenance
- Last release
- 11 days ago
- Releases, 24 months
- 6
- Tested up to
- 7.1 current
- Requires PHP
- 7.4 supported 8.2+
| Q1 2024 | 0 |
|---|---|
| Q2 2024 | 0 |
| Q3 2024 | 0 |
| Q4 2024 | 1 |
| Q1 2025 | 0 |
| Q2 2025 | 0 |
| Q3 2025 | 0 |
| Q4 2025 | 0 |
| Q1 2026 | 0 |
| Q2 2026 | 1 |
| Q3 2026 | 0 |
| Q4 2026 | 4 |
Last release 24 Oct 2026. Tested with WordPress 7.1 (current).
Support
- Resolved, last 2 months
- 100%
- Threads, last 2 months
- 1
Trend appears after 8 weekly snapshots.
Security record
1 vulnerability on record, 1 with no fix in the current version.
| Date | Issue | CVSS | Affected | Fixed in | Days to patch |
|---|---|---|---|---|---|
| 28 Jun 2021 | Authenticated Insecure Direct Object Reference | 4.3 | < 2.6.0 | No fix | n/a |
Changelog mentions of security fixes: 1.0.7 (security).
Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.
Reputation
Last 90 days: no reviews. Lifetime: 5.0.
| Last 90 days | No reviews |
|---|---|
| Lifetime | 5.0 |
| 5 star | 2 |
|---|---|
| 4 star | 0 |
| 3 star | 0 |
| 2 star | 0 |
| 1 star | 0 |
Momentum
- Active installs
- 4,000+
- Downloads, last full week
- 815
| 4 May 2026 | 39 |
|---|---|
| 11 May 2026 | 78 |
| 18 May 2026 | 91 |
| 25 May 2026 | 71 |
| 1 Jun 2026 | 109 |
| 8 Jun 2026 | 1,729 |
| 15 Jun 2026 | 411 |
| 22 Jun 2026 | 327 |
| 29 Jun 2026 | 292 |
| 6 Jul 2026 | 431 |
| 13 Jul 2026 | 216 |
| 20 Jul 2026 | 225 |
| 27 Jul 2026 | 224 |
| 3 Aug 2026 | 206 |
| 10 Aug 2026 | 215 |
| 17 Aug 2026 | 209 |
| 24 Aug 2026 | 191 |
| 31 Aug 2026 | 241 |
| 7 Sep 2026 | 170 |
| 14 Sep 2026 | 190 |
| 21 Sep 2026 | 171 |
| 28 Sep 2026 | 180 |
| 5 Oct 2026 | 239 |
| 12 Oct 2026 | 1,623 |
| 19 Oct 2026 | 1,665 |
| 26 Oct 2026 | 815 |
Weekly downloads over the last 4 weeks are 172% above the 26-week average.
Healthier alternatives
Same job, rated Healthy, higher Canary Score. Never sponsored.
Facts
- Full name
- User Profile Picture - Custom Local Avatars
- Version
- 1.0.10
- Author
- Dew Technolab
- Added
- 24 Sep 2019
- Last updated
- 24 Oct 2026
- Active installs
- 4,000+
- Requires WordPress
- 4.5
- Tested up to
- 7.1.4
- Requires PHP
- 7.4
- Category
- User Management & Authentication > User Profiles & Avatars
- Tags
- avatar, user avatar, local avatar, custom avatar, profile picture
Other plugins by this author: UPI QR Code Payment Gateway, Hide Shipping Methods for WooCommerce, User Registration and Login, COD to UPI
Questions about User Profile Picture
Is User Profile Picture still maintained?
Yes. Last release 24 Oct 2026, 6 releases in the last 24 months.
Who owns User Profile Picture, and has it changed hands?
No change recorded. Main committer dewtechnolab since Sep 2019.
Was User Profile Picture removed from wordpress.org?
No. Listed on wordpress.org as of 3 Nov 2026.
Is User Profile Picture safe?
No. 1 known vulnerability has no fix in the current version.
Is the latest User Profile Picture update safe to install?
No ownership change before 1.0.10. No one-star spike after it.