Description
Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3.1 versions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| BuddyDev | BuddyPress Xprofile Custom Field Types | ≤ 1.3.1 | — |
High · 8.8
CVE-2026-116868
EUVD-2026-112988GHSA-36p3-wc2w-xmm3
WordPress BuddyPress Xprofile Custom Field Types plugin <= 1.3.1 - PHP Object Injection vulnerability
Published Oct 29, 2026 · Updated Oct 29, 2026 · Assigned by Patchstack