BuddyPress Xprofile Custom Field Types

BuddyPress Xprofile Custom Field Types has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of September 2026. Their average CVSS score is 8.8, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high.

The most common weakness is Path Traversal, behind 1 of the records (100%).

The one issue recorded for BuddyPress Xprofile Custom Field Types has a vendor fix available, so running the current release closes it.

All of these findings were reported by Sarawut Poolkhet (MisterHelloz). BuddyPress Xprofile Custom Field Types is installed on roughly 4,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.

Strategic Overview

Avg CVSSHigh
8.8/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all BuddyPress Xprofile Custom Field Types vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2025-14997

BuddyPress Xprofile Custom Field Types <= 1.2.8 - Authenticated (Subscriber+) Arbitrary File Deletion

Read the full analysis

Vulnerability Records

1 records
BuddyPress Xprofile Custom Field Types banner
Latestv1.3.1

BuddyPress Xprofile Custom Field Types

BuddyDev

Author

BuddyDev

4.9(16)
98/100
Last Updated
2026-04-08 (5mo ago)
Active Installs
4,000+
Downloads
151,317
Requires WP
5.0+
Requires PHP
5.3+
Tested up to
WP 6.9.7
Created
2018-05-28 (8y ago)

BuddyPress Xprofile Custom Field Types plugin adds some essential field types to BuddyPress Profile. The newly added BuddyPress field types are:- * Birthdate. * Image. * File. * Checkbox acceptance. * Country field. * From/To field(can be used to show 2 numbers or text strings). * Token (can be used to set a list of predefined approved codes for registration etc). * oEmbed ( allow your users to use youtube/facebook, vimeo and other oembed supporting urls to embed in their profile). * Email. * Web. * Datepicker. * Custom post type selector. * Custom post type multiselector. * Colorpicker. * Decimal number. * Number within min/max values. * Custom taxonomy selector. * Custom taxonomy multiselector. * Range input (slider) * Select2 javascript plugin for select boxes. BuddyPress Xprofile Custom Field Types is 100% compatible with BP Profile Search plugin. At the moment, following fields are searchable using BP Profile Search:- * Birthdate * Datepicker * Color * Email * Web * Number Min/Max * Range Input * Decimal Number * Country Other fields such as post type, taxonomy etc., are not searchable as they are stored in serialized format( due to back compatibility). The plugin is opensource and currently developed on github. We welcome you to be part of its future development at https://github.com/buddydev/bp-xprofile-custom-field-types. Discuss the plugin on our release post or view the plugin’s detailed documentation here. The idea is based on @donmik’s plugin. This plugin is a complete rewrite. Some field type do share code with the original plugin. My guess, we are using 20-30% of the code for field types from the original. In the future, we hope to add more fields. Note: This plugin is not 100% backward compatible It is very easy to migrate. Should take less than 5 minute. If you are looking to move from the older plugin to this one, please read our migration guide. Note 2: The Custom taxonomy field does not allow you to categorize users. They allow you to let users select some terms and display the terms on their profile. It is not intended for classifying user Credit @donmik for the BuddyPress Xprofile Custom Fields Type from where we adopted the field types in our first version. In the first version, te plugin brought all the profile fields offered by the currently abandoned The “BuddyPress Xprofile Custom Fields Type” plugin. More Plugins We love BuddyPress, and we have created 100+ BuddyPress plugins. Please take a look at our 1. Free BuddyPress Plugins 1. Premium BuddyPress plugins We hope that it will help you take your BuddyPress network to the next level. BuddyPress Custom development & Maintenance Service If you need any assistance with setting up or adding new features to BuddyPress or this plugin, Our team is available for hire. Please use our BuddyPress Development Services for any custom development needs.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C