buddypress_xprofile_custom_image_field vulnerabilities

CVEs whose affected-version data names the buddypress_xprofile_custom_image_field package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-120518Critical· 9.1

5d ago

BuddyPress XProfile Image Field <= 3.1.0 - Unauthenticated Arbitrary File Deletion via Signup Image Field Activation Handler

The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.1.0. This is due to bpxp_image_field_update_on_user_activation() calling unlink() on a path built f…

▾ Midnightkalengi · BuddyPress XProfile Custom Image FieldEPSS 0.78%via CVEORG