BuddyPress XProfile Custom Image Field

BuddyPress XProfile Custom Image Field has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2025 and 2026; 1 is fixed and 1 remains unpatched as of October 2026. Their average CVSS score is 9.1, and the most serious one scores 9.1 out of 10. Severity breakdown: 2 critical and 0 high.

The most common weakness is Path Traversal, behind 2 of the records (100%).

1 of the records (50%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.

2 independent researchers contributed these findings, one record each.

Strategic Overview

Avg CVSSCritical

9.1/ 10

Patch Coverage50%

Open

Fixed

Get automatic notifications for all BuddyPress XProfile Custom Image Field vulnerabilities before they are exploited.

Most severe open issueCVSS 9.1

BuddyPress XProfile Image Field <= 3.1.0 - Unauthenticated Arbitrary File Deletion via Signup Image Field Activation Handler

Read the full analysis

Vulnerability Records

2 records


2026-10-13 15:18	BuddyPress XProfile Image Field <= 3.1.0 - Unauthenticated Arbitrary File Deletion via Signup Image Field Activation Handler BuddyPress XProfile Custom Image Field <= 3.1.0	`N/A`	9.1 Critical	jun2e0	No
2025-07-31 00:00	BuddyPress XProfile Custom Image Field <= 3.0.1 - Unauthenticated Arbitrary File Deletion BuddyPress XProfile Custom Image Field <= 3.0.1	`CVE-2025-48158`	9.1 Critical	Martino Spagnuolo	Yes

Showing 1–2 of 2 reports