Skip to content

Buddydev vulnerabilities

Products

Newest

buddydev buddypress xprofile custom field types WordPress BuddyPress Xprofile Custom Field Types plugin <= 1.3.1 - PHP Object Injection vulnerability CVE-2026-116868 8.8 HighOctober 29, 2026
buddydev mediapress WordPress MediaPress plugin <= 1.6.2 - Cross Site Scripting (XSS) vulnerability CVE-2026-22519 6.5 MediumJanuary 8, 2026
buddydev mediapress MediaPress <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's Shortcode CVE-2025-14552 6.4 MediumJanuary 6, 2026
buddydev buddypress xprofile custom field types BuddyPress Xprofile Custom Field Types <= 1.2.8 - Authenticated (Subscriber+) Arbitrary File Deletion CVE-2025-14997 8.8 HighJanuary 6, 2026
buddydev buddypress activity shortcode WordPress BuddyPress Activity Shortcode plugin <= 1.1.8 - Cross Site Scripting (XSS) vulnerability CVE-2025-62760 6.5 MediumDecember 31, 2025
buddydev activity plus reloaded for buddypress WordPress Activity Plus Reloaded for BuddyPress plugin <= 1.1.2 - Cross Site Scripting (XSS) vulnerability CVE-2025-62949 6.5 MediumOctober 27, 2025
buddydev buddypress notification widget WordPress BuddyPress Notification Widget Plugin <= 1.3.3 - Cross Site Scripting (XSS) Vulnerability CVE-2025-58263 6.5 MediumSeptember 22, 2025
buddydev mediapress WordPress MediaPress Plugin <= 1.5.9.1 - Local File Inclusion Vulnerability CVE-2025-58608 7.5 HighSeptember 3, 2025
buddydev activity plus reloaded for buddypress WordPress Activity Plus Reloaded for BuddyPress plugin <= 1.1.2 - Broken Access Control Vulnerability CVE-2025-30957 5.4 MediumJune 6, 2025
buddydev activity plus reloaded for buddypress Activity Plus Reloaded for BuddyPress <= 1.1.1 - Authenticated (Subscriber+) Blind Server-Side Request Forgery CVE-2024-11913 5.4 MediumJanuary 24, 2025