TI-2025-09354 CVE-2025-10189 · GHSA-8f3q-rm3v-cm52
BP Direct Menus <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Priority LOW 28
The BP Direct Menus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bpdm_login' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output…