Skip to content
OpenAdvisories

Vendor

BuddyDev

10 known vulnerabilities.

Products

Activity Plus Reloaded for BuddyPress 3 MediaPress 3 BuddyPress Xprofile Custom Field Types 2 BuddyPress Activity Shortcode 1 BuddyPress Notification Widget 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.8
    CVE-2026-116868

    WordPress BuddyPress Xprofile Custom Field Types plugin <= 1.3.1 - PHP Object Injection vulnerability

    Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3.1 versions.

    BuddyDev BuddyPress Xprofile Custom Field Types
  • High 8.8
    CVE-2025-14997

    BuddyPress Xprofile Custom Field Types <= 1.2.8 - Authenticated (Subscriber+) Arbitrary File Deletion

    The BuddyPress Xprofile Custom Field Types plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete_field' function in all versions up to, and including, 1.2.8. This makes it possible for authentica…

    BuddyDev BuddyPress Xprofile Custom Field Types Web / CMS
  • High 7.5
    CVE-2025-58608

    WordPress MediaPress Plugin <= 1.5.9.1 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BuddyDev MediaPress mediapress allows PHP Local File Inclusion.This issue affects MediaPress: from n/a through <= 1.5.9.1.

    BuddyDev MediaPress