buddydev vulnerabilities
10 published CVEs name buddydev among the affected products.
- 10Published CVEs10 of them scored
- 5Last 12 monthspublished in the last year
- 0Critical3 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-116868
WordPress BuddyPress Xprofile Custom Field Types plugin <= 1.3.1 - PHP Object Injection vulnerability
BuddyDev · BuddyPress Xprofile Custom Field Types
High8.8 - CVE-2026-22519
WordPress MediaPress plugin <= 1.6.2 - Cross Site Scripting (XSS) vulnerability
BuddyDev · MediaPress
Medium6.5 - CVE-2025-14552
MediaPress <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's Shortcode
buddydev · MediaPress
Medium6.4 - CVE-2025-14997
BuddyPress Xprofile Custom Field Types <= 1.2.8 - Authenticated (Subscriber+) Arbitrary File Deletion
buddydev · BuddyPress Xprofile Custom Field Types
High8.8 - CVE-2025-62760
WordPress BuddyPress Activity Shortcode plugin <= 1.1.8 - Cross Site Scripting (XSS) vulnerability
BuddyDev · BuddyPress Activity Shortcode
Medium6.5 - CVE-2025-62949
WordPress Activity Plus Reloaded for BuddyPress plugin <= 1.1.2 - Cross Site Scripting (XSS) vulnerability
BuddyDev · Activity Plus Reloaded for BuddyPress
Medium6.5 - CVE-2025-58263
WordPress BuddyPress Notification Widget Plugin <= 1.3.3 - Cross Site Scripting (XSS) Vulnerability
BuddyDev · BuddyPress Notification Widget
Medium6.5 - CVE-2025-58608
WordPress MediaPress Plugin <= 1.5.9.1 - Local File Inclusion Vulnerability
BuddyDev · MediaPress
High7.5 - CVE-2025-30957
WordPress Activity Plus Reloaded for BuddyPress plugin <= 1.1.2 - Broken Access Control Vulnerability
BuddyDev · Activity Plus Reloaded for BuddyPress
Medium5.4 - CVE-2024-11913
Activity Plus Reloaded for BuddyPress <= 1.1.1 - Authenticated (Subscriber+) Blind Server-Side Request Forgery
buddydev · Activity Plus Reloaded for BuddyPress
Medium5.4