Skip to content

CVE record · 1 source

CVE-2026-120518

CVSS 9.1

The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.1.0.

Vendor: Kalengi
Product: BuddyPress XProfile Custom Image Field
CVSS v3.1: 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Weakness: CWE-22
Exposure class: Web platform

Coverage

1

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

38

CVE NVD 1h ago

The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.1.0.

The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.1.0. This is due to bpxp_image_field_update_on_user_activation() calling unlink() on a path…

CVSS 9.1 CVE-2026-120518 Kalengi