Skip to content
OpenAdvisories

Vendor

kalengi

1 known vulnerabilities.

Products

BuddyPress XProfile Custom Image Field 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.1
    CVE-2026-120518

    BuddyPress XProfile Image Field <= 3.1.0 - Unauthenticated Arbitrary File Deletion via Signup Image Field Activation Handler

    The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.1.0. This is due to bpxp_image_field_update_on_user_activation() calling unlink() on a path built from visitor-supplied s…

    kalengi BuddyPress XProfile Custom Image Field Web / CMS