Skip to content
OpenAdvisories
High · 8.6 CVE-2025-48158 EUVD-2025-25374GHSA-fw2c-m258-65f8

WordPress BuddyPress XProfile Custom Image Field Plugin <= 3.0.1 - Arbitrary File Deletion Vulnerability

Published Aug 20, 2025 · Updated Apr 28, 2026 · Assigned by Patchstack

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Alex Githatu BuddyPress XProfile Custom Image Field buddypress-xprofile-image-field allows Path Traversal.This issue affects BuddyPress XProfile Custom Image Field: from n/a through <= 3.0.1.

Affected products

VendorProductAffectedFixed
Alex Githatu BuddyPress XProfile Custom Image Field ≤ 3.0.1 —

References