BuddyPress Xprofile Custom Field Types
BuddyPress Xprofile Custom Field Types adds custom field types for BuddyPress extended member profiles.
BuddyPress Xprofile Custom Field Types (bp-xprofile-custom-field-types) is a WordPress plugin with 2 published CVE records in this archive. The latest tracked vulnerability was published Oct 29, 2026; the highest published CVSS base score is 8.8.
bp-xprofile-custom-field-typesCVE-2026-116868: BuddyPress Xprofile Custom Field Types: PHP object injection
Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3.1 versions. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. Untrusted deserialization may create PHP objects; code execution requires a usable gadget chain and its prerequisites, neither of which is established by this record. The structured affected range is n/a through 1.3.1.
| Safe version |
|
||
|---|---|---|---|
| Oct 29, 2026 |
CVE-2026-116868
BuddyPress Xprofile Custom Field Types: PHP object injection
Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3.1 versions. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. Untrusted deserialization may create PHP objects; code execution requires a usable gadget chain and its prerequisites, neither of which is established by this record. The structured affected range is n/a through 1.3.1.
|
See mitigation notes |
CVE8.8
|
| Jan 06, 2026 |
CVE-2025-14997
BuddyPress Xprofile Custom Field Types: Code execution
BuddyPress Xprofile Custom Field Types is affected by code execution. Exploitation requires an authenticated subscriber account. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
|
See mitigation notes |
CVE8.8
|