BuddyDev
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| Activity Plus Reloaded for BuddyPress | 3 | – | Oct 27, 2025 |
| MediaPress | 3 | – | Jan 8, 2026 |
| BuddyPress Xprofile Custom Field Types | 2 | – | Oct 29, 2026 |
| BuddyPress Activity Shortcode | 1 | – | Dec 31, 2025 |
| BuddyPress Notification Widget | 1 | – | Sep 22, 2025 |
Exploited and recent CVEs
- CVE-2026-116868 WordPress BuddyPress Xprofile Custom Field Types plugin <= 1.3.1 - PHP Object Injection vulnerability 0.4%
- CVE-2026-22519 WordPress MediaPress plugin <= 1.6.2 - Cross Site Scripting (XSS) vulnerability 0.2%
- CVE-2025-14552 MediaPress <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's Shortcode 0.2%
- CVE-2025-14997 BuddyPress Xprofile Custom Field Types <= 1.2.8 - Authenticated (Subscriber+) Arbitrary File Deletion 0.7%
- CVE-2025-62760 WordPress BuddyPress Activity Shortcode plugin <= 1.1.8 - Cross Site Scripting (XSS) vulnerability 0.2%
- CVE-2025-62949 WordPress Activity Plus Reloaded for BuddyPress plugin <= 1.1.2 - Cross Site Scripting (XSS) vulnerability 0.2%
- CVE-2025-58263 WordPress BuddyPress Notification Widget Plugin <= 1.3.3 - Cross Site Scripting (XSS) Vulnerability 0.2%
- CVE-2025-58608 WordPress MediaPress Plugin <= 1.5.9.1 - Local File Inclusion Vulnerability 0.6%
- CVE-2025-30957 WordPress Activity Plus Reloaded for BuddyPress plugin <= 1.1.2 - Broken Access Control Vulnerability 0.3%
- CVE-2024-11913 Activity Plus Reloaded for BuddyPress <= 1.1.1 - Authenticated (Subscriber+) Blind Server-Side Request Forgery 0.2%