Buddydev

9 CVEs across 6 Buddydev products. Browse Buddydev vulnerabilities, severities, and proof-of-concept exploits.

Buddydev products with known CVEs

ProductCVEs
Activity Plus Reloaded For Buddypress3
Mediapress3
Activity Plus Reloaded For Buddypress1
Buddypress Activity Shortcode1
Buddypress Notification Widget1
Buddypress Xprofile Custom Field Types1
Buddydev CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-22519Medium6.52026-01-08Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddyDev MediaPress mediapress allows Stored XSS.This iss…
CVE-2025-14552Medium6.42026-01-06The MediaPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mpp-uploader shortcode in all versions up to, and including…
CVE-2025-14997High8.82026-01-06The BuddyPress Xprofile Custom Field Types plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delet…
CVE-2025-62760Medium6.52025-12-31Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddyDev BuddyPress Activity Shortcode bp-activity-shortc…
CVE-2025-62949Medium6.52025-10-27Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddyDev Activity Plus Reloaded for BuddyPress bp-activit…
CVE-2025-58263Medium6.52025-09-22Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddyDev BuddyPress Notification Widget buddypress-notifi…
CVE-2025-58608High7.52025-09-03Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BuddyDev MediaPress mediapress allows…
CVE-2025-30957Medium5.42025-06-06Missing Authorization vulnerability in BuddyDev Activity Plus Reloaded for BuddyPress bp-activity-plus-reloaded allows Exploiting Incorrectly Configured Access…
CVE-2024-11913Medium5.42025-01-24The Activity Plus Reloaded for BuddyPress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.1.1 v…