WordPress security by component

BuddyPress Xprofile Custom Field Types

Plugin description

BuddyPress Xprofile Custom Field Types is a WordPress component with 1 published CVE record in this archive. The latest tracked vulnerability was published Jan 06, 2026; the highest CVE/CNA score is 8.8.

Plugin slug: bp-xprofile-custom-field-types

Latest vulnerability

CVE-2025-14997: BuddyPress Xprofile Custom Field Types: Code execution

BuddyPress Xprofile Custom Field Types is affected by code execution. Exploitation requires at least subscriber-level access. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

PublishedJan 06, 2026

Safe version guidanceSee mitigation notes

		Safe version
Jan 06, 2026	CVE-2025-14997 BuddyPress Xprofile Custom Field Types: Code execution BuddyPress Xprofile Custom Field Types is affected by code execution. Exploitation requires at least subscriber-level access. Successful exploitation can run attacker-controlled code in the WordPress hosting account.	See mitigation notes	CVE8.8 NVDPending