Activity Plus Reloaded for BuddyPress
Activity Plus Reloaded for BuddyPress has 3 disclosed vulnerabilities in the WordSec catalog, all reported in 2025; 1 is fixed and 2 remain unpatched as of September 2026. Their average CVSS score is 5.4, and the most serious one scores 6.4 out of 10. 2025 was the busiest year with 3 disclosures.
The most common weakness is Cross-Site Scripting, behind 1 of the records (33%). Other recurring categories include Missing Authorization, Server-Side Request Forgery (SSRF).
1 of the records (33%) have a vendor fix, while 2 remain unpatched. The oldest unresolved one dates back to 2025.
3 independent researchers contributed these findings, one record each. Activity Plus Reloaded for BuddyPress is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.7.7.
CVE-2025-62949Activity Plus Reloaded for BuddyPress <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records
Activity Plus Reloaded for BuddyPress
Author
BuddyDev
Activity Plus Reloaded for BuddyPress gives your social network all the features and ease of Facebook when it comes to uploading and sharing media! It is a fork of now unmaintained BuddyPress Activity Plus The plugin adds 3 new buttons to your BuddyPress activity stream. Enabling you to attach photos, videos, and even share web links with everyone on your network! Here’s the quick overview of this plugin’s features: * Upload a photo (or multiple) directly from your computer to the activity stream * Embed a video from popular sites such as youtube and vimeo by copying the link * Embed a link to any site – the site title and description will automatically be pulled in * Embedding a link also allows you to choose a thumbnail image from a list of images on the site’s homepage * Works perfectly with any theme based on the BuddyPress Default theme Blog Post :Introducing BuddyPress Activity Plus Reloaded Credit Activity Plus Reloaded for BuddyPress is a fork of BuddyPress Activity Plus(now abandoned) by @wpmudev. We have refactored it to wok with current BuddyPress/WordPress. and we plan to maintain and further develop it. We would like to express our sincere gratitude to the @wpmudv team for their cooperation in getting this plugin back. If you are looking to optimize media, We recommend Smush to optimize your BuddyPress media. Contribute The plugin is available on gihub. You can contribute by sending pull request, reporting errors and helping others. Github repository: https://github.com/buddydev/bp-activity-plus-reloaded Support & reporting Issues: BuddyDev Forums
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C