TI-2026-82588 CVE-2026-116868 · GHSA-36p3-wc2w-xmm3
PHP Object Injection in BuddyPress Xprofile Custom Field Types plugin
Priority MEDIUM 40
Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3.1 versions.
Vulnerabilities
10 records
TI-2026-18100 CVE-2026-22519 · GHSA-859g-62gq-28q4
WordPress MediaPress plugin <= 1.6.2 - Cross Site Scripting (XSS) vulnerability
Priority LOW 28
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddyDev MediaPress mediapress allows Stored XSS.This issue affects MediaPress: from n/a through <= 1.6.2.
TI-2025-13294 CVE-2025-14552 · GHSA-rw7g-7xvc-g4p7
MediaPress <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's Shortcode
Priority LOW 28
The MediaPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mpp-uploader shortcode in all versions up to, and including, 1.6.1 due to insufficient input sanitization and output escap…
TI-2025-13680 CVE-2025-14997 · GHSA-6qr6-x63g-2597
BuddyPress Xprofile Custom Field Types <= 1.2.8 - Authenticated (Subscriber+) Arbitrary File Deletion
Priority MEDIUM 41
The BuddyPress Xprofile Custom Field Types plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete_field' function in all versions up to, and including, 1.2.8…
TI-2025-38949 CVE-2025-62760 · GHSA-3gwg-rh47-h7p4
WordPress BuddyPress Activity Shortcode plugin <= 1.1.8 - Cross Site Scripting (XSS) vulnerability
Priority LOW 28
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddyDev BuddyPress Activity Shortcode bp-activity-shortcode allows Stored XSS.This issue affects BuddyPress Activity…
TI-2025-39097 CVE-2025-62949 · GHSA-rqm5-mx2c-5fhp
WordPress Activity Plus Reloaded for BuddyPress plugin <= 1.1.2 - Cross Site Scripting (XSS) vulnerability
Priority LOW 28
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddyDev Activity Plus Reloaded for BuddyPress bp-activity-plus-reloaded allows Stored XSS.This issue affects Activity…
TI-2025-36068 CVE-2025-58263 · GHSA-x97p-v74q-wcwj
WordPress BuddyPress Notification Widget Plugin <= 1.3.3 - Cross Site Scripting (XSS) Vulnerability
Priority LOW 28
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddyDev BuddyPress Notification Widget buddypress-notifications-widget allows Stored XSS.This issue affects BuddyPres…
TI-2025-36276 CVE-2025-58608 · GHSA-gmhv-gv33-jvq7
WordPress MediaPress Plugin <= 1.5.9.1 - Local File Inclusion Vulnerability
Priority LOW 36
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BuddyDev MediaPress mediapress allows PHP Local File Inclusion.This issue affects MediaPress: from…
TI-2025-22227 CVE-2025-30957 · GHSA-55jp-3p8j-2972
WordPress Activity Plus Reloaded for BuddyPress plugin <= 1.1.2 - Broken Access Control Vulnerability
Priority LOW 24
Missing Authorization vulnerability in BuddyDev Activity Plus Reloaded for BuddyPress bp-activity-plus-reloaded allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Activity Plus Rel…
TI-2024-11052 CVE-2024-11913 · GHSA-j95r-rm3w-f776
Activity Plus Reloaded for BuddyPress <= 1.1.1 - Authenticated (Subscriber+) Blind Server-Side Request Forgery
Priority LOW 24
The Activity Plus Reloaded for BuddyPress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.1.1 via the 'ajax_preview_link' function.