Plugin Pulse
← Pulse

User Avatar – Reloaded

by Saad Iqbal · Login & Users

Also makes 49 other plugins · 1.3M+ installs across the portfolio →

Free audit wp.org ↗

Use any image from your WordPress Media Library as a custom user avatar or user profile picture. Add your own Default Avatar.

⚠ Stale⚠ Likely abandoned⚠ Few reviews
How scoring works →
48 Health · D
Maintenance 9/100
Rating quality 76/100
Support 70/100

48 health vs 59 average across 1,441 Login & Users plugins

800+

Active installs

≈860 estimated

11.0K

Total downloads

since 2021

4.06★

Rating (adjusted)

5.0★ raw · 2 reviews

+28%

214

Downloads · 30d

category median +16%

Removal-risk signals

28/100

Maintenance and integrity signals that tend to precede a WordPress.org removal. Not an official status, a heads-up to act.

  • Not actively maintained. No update in about 2 years.

Directory ranking optimization

How it's scored →

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

55 / 100

Room to improve

Biggest win: Update recency

Update recency 18/100
WP compatibility 60/100
Rating quality 52/100
Listing tuning 100/100

To rank higher: Last updated 1079 days ago — ship an update; wp.org decays a listing's search weight after ~180 days.

Get the full rank-higher report →

Daily downloads

Since 2022-10-05 · 1,424 days · wp.org + Plugin Pulse archive

+28% vs prior 30d
12Downloads · Aug 26

30-day downloads

Rolling 30-day volume · peaks are release surges

214

now · peak 913

21130d downloads · Aug 26

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

User Avatar · #7359 you User Profile Picture · #879 Basic User Avatars · #1174 Easy Author Avatar I · #5751

Update activity

How busy the existing users are, measured as downloads in the last 30 days for every 1,000 active sites. A spike means a new release everyone's pulling; a long, slow decline means an aging user base that updates less.

264per 1k installs · Aug 26

Release cadence

No release in a year
from wp.org release tags

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

0

releases in the last 12 months

3.0y ago

latest release · v1.2.2

5

tagged releases on record

Recent releases

1.2.2 · 3.0y ago1.2.1 · 3.0y ago1,2 · 3.0y ago1.1 · 4.5y ago1.0 · 4.5y ago

What its installed base runs

via wordpress.org

Share of active installs on each version of this plugin · 94% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

v1.2 94%
v1.1 5.9%

Estimated active installs

The public count shows “800+”. Our estimate pins where the real number sits.

modeled estimate
800–900 ≈860

Modeled within the band wp.org reports; tightens as we track daily.

Install history · since 2022-03-20 · 1,421 observations

800Installs · Aug 26

Estimated value

What this plugin might earn a year, and what it might sell for. Modeled from public signals; we don't see anyone's books.

Est. annual revenue

N/A

Est. acquisition value

N/A

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. A small install base leaves thin data to model from.

Ratings · 2 reviews

Read on wp.org ↗
5★
2 4★
0 3★
0 2★
0 1★
0

Details

Version
1.2.2
Last updated
3.0y ago
Added
2021-05-28 · 5 yrs old
Requires WP
4.0
Tested up to
6.3.10
Requires PHP
5.6
Changelog ↗Support forum ↗Reviews ↗Advanced stats ↗

Known vulnerabilities

via Wordfence Intelligence

2 disclosed vulnerabilities on record for this plugin, 1 still affects the current version.

  1. Medium · 6.4 User Avatar - Reloaded <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2025-09-28 CVE-2025-68080 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.2.2 No patch available
  2. Medium · 6.4 User Avatar – Reloaded <= 1.2.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2023-09-25 CVE-2023-4798 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.2.1 Patched in 1.2.2

Vulnerability records provided by Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. License and terms.

CVE records: Copyright 1999-2026 The MITRE Corporation. CVE terms of use.

Behavioral tests

via WP Hive

Automated install-time checks, tested on PHP 8.1.12 · WP 6.3.1

✓ Low memory footprint
✓ Low page-speed impact
✓ Runs on latest PHP + WP
✓ No PHP errors
✓ No JS errors
✓ Activates cleanly
✓ No resource errors
✓ No external HTTP errors
✓ Optimized database use
✕ Frequently updated

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

  1. 2026-08-27 900+ → 800+ down after 13 days in tier
  2. 2026-08-14 800+ → 900+ up after 1 days in tier
  3. 2026-08-13 900+ → 800+ down after 1 days in tier
  4. 2026-08-12 800+ → 900+ up after 2 days in tier
  5. 2026-08-10 900+ → 800+ down after 127 days in tier
  6. 2026-04-05 1K+ → 900+ down after 1 days in tier
  7. 2026-04-04 900+ → 1K+ up after 36 days in tier
  8. 2026-02-27 1K+ → 900+ down after 3 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Compare head to head →

Embed this report card

Drop a live Pulse card for User Avatar – Reloaded into a readme, a review or a deck. It updates itself.

<iframe src="https://plugins.wpmayor.com/embed/user-avatar-reloaded" width="480" height="300" style="border:0" loading="lazy" title="User Avatar – Reloaded — Plugin Pulse"></iframe>
Preview card ↗

User Avatar – Reloaded: 800+ active installs, 5.0★ (2 reviews). Plugin Pulse (WP Mayor), as of 2026-08-28. https://plugins.wpmayor.com/plugin/user-avatar-reloaded