Vulnerabilities

TI-2026-73825 CVE-2026-104995 · GHSA-46v5-32pc-qx73

Unauthenticated local file inclusion in BP Profile Search plugin

LOW 39

The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajax_template' value parsed from the client-controlled 'bps_directory' cookie during BuddyPr…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.01101 Published 2026-10-14 No fix listed CWE-98

TI-2024-07275 CVE-2024-7850 · GHSA-mpcg-jpxc-257w

BP Profile Search <= 5.7.5 - Cross-Site Request Forgery to Reflected Cross-Site Scripting

LOW 27

The BP Profile Search plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.7.5.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00228 Published 2024-08-20 No fix listed CWE-352

TI-2024-14880 CVE-2024-22293 · GHSA-6p59-4pch-3x39

WordPress BP Profile Search Plugin <= 5.5 is vulnerable to Cross Site Scripting (XSS)

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andrea Tarantini BP Profile Search allows Reflected XSS.This issue affects BP Profile Search: from n/a through 5.5.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00331 Published 2024-01-31 No fix listed CWE-79

TI-2023-18502 CVE-2023-36687 · GHSA-xh56-3cv8-89c9

WordPress Menubar Plugin <= 5.8.2 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 28

Cross-Site Request Forgery (CSRF) vulnerability in Andrea Tarantini Menubar plugin <= 5.8.2 versions.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.0022 Published 2023-07-11 No fix listed CWE-352

Vulnerabilities

Filters

Unauthenticated local file inclusion in BP Profile Search plugin

BP Profile Search <= 5.7.5 - Cross-Site Request Forgery to Reflected Cross-Site Scripting

WordPress BP Profile Search Plugin <= 5.5 is vulnerable to Cross Site Scripting (XSS)

WordPress Menubar Plugin <= 5.8.2 is vulnerable to Cross Site Request Forgery (CSRF)