Skip to content
OpenAdvisories

Vendor

BuddyDev

10 known vulnerabilities.

BuddyDev at a glance

Last 12 months
5
Critical · all time
0
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 3 5 December 2025: 1 vulnerability Dec 2025 January 2026: 3 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 1 vulnerability November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202610
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202630
Dec 202510
Nov 202500
Oct 202510
Sep 202520
Aug 202500
Jul 202500
Jun 202510
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202510
Dec 202400

Products

Activity Plus Reloaded for BuddyPress 3 MediaPress 3 BuddyPress Xprofile Custom Field Types 2 BuddyPress Activity Shortcode 1 BuddyPress Notification Widget 1
All Critical High Medium Low Exploited only Public exploit

10 results · Feed

  • High 8.8
    CVE-2026-116868

    WordPress BuddyPress Xprofile Custom Field Types plugin <= 1.3.1 - PHP Object Injection vulnerability

    Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3.1 versions.

    BuddyDev BuddyPress Xprofile Custom Field Types
  • Medium 6.5
    CVE-2026-22519

    WordPress MediaPress plugin <= 1.6.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddyDev MediaPress mediapress allows Stored XSS.This issue affects MediaPress: from n/a through <= 1.6.2.

    BuddyDev MediaPress
  • Medium 6.4
    CVE-2025-14552

    MediaPress <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's Shortcode

    The MediaPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mpp-uploader shortcode in all versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This m…

    BuddyDev MediaPress Web / CMS
  • High 8.8
    CVE-2025-14997

    BuddyPress Xprofile Custom Field Types <= 1.2.8 - Authenticated (Subscriber+) Arbitrary File Deletion

    The BuddyPress Xprofile Custom Field Types plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete_field' function in all versions up to, and including, 1.2.8. This makes it possible for authentica…

    BuddyDev BuddyPress Xprofile Custom Field Types Web / CMS
  • Medium 6.5
    CVE-2025-62760

    WordPress BuddyPress Activity Shortcode plugin <= 1.1.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddyDev BuddyPress Activity Shortcode bp-activity-shortcode allows Stored XSS.This issue affects BuddyPress Activity Shortcode: from n/a through <= 1.1.8.

    BuddyDev BuddyPress Activity Shortcode
  • Medium 6.5
    CVE-2025-62949

    WordPress Activity Plus Reloaded for BuddyPress plugin <= 1.1.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddyDev Activity Plus Reloaded for BuddyPress bp-activity-plus-reloaded allows Stored XSS.This issue affects Activity Plus Reloaded for BuddyPress: from n/a…

    BuddyDev Activity Plus Reloaded for BuddyPress
  • Medium 6.5
    CVE-2025-58263

    WordPress BuddyPress Notification Widget Plugin <= 1.3.3 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddyDev BuddyPress Notification Widget buddypress-notifications-widget allows Stored XSS.This issue affects BuddyPress Notification Widget: from n/a through…

    BuddyDev BuddyPress Notification Widget
  • High 7.5
    CVE-2025-58608

    WordPress MediaPress Plugin <= 1.5.9.1 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BuddyDev MediaPress mediapress allows PHP Local File Inclusion.This issue affects MediaPress: from n/a through <= 1.5.9.1.

    BuddyDev MediaPress
  • Medium 5.4
    CVE-2025-30957

    WordPress Activity Plus Reloaded for BuddyPress plugin <= 1.1.2 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in BuddyDev Activity Plus Reloaded for BuddyPress bp-activity-plus-reloaded allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Activity Plus Reloaded for BuddyPress: from n/a through …

    BuddyDev Activity Plus Reloaded for BuddyPress
  • Medium 5.4
    CVE-2024-11913

    Activity Plus Reloaded for BuddyPress <= 1.1.1 - Authenticated (Subscriber+) Blind Server-Side Request Forgery

    The Activity Plus Reloaded for BuddyPress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.1.1 via the 'ajax_preview_link' function. This makes it possible for authenticated attackers, with Subscr…

    BuddyDev Activity Plus Reloaded for BuddyPress Web / CMS