Skip to content
Threat Feed
Subscribe

Product

BuddyPress XProfile Image Field (<= 3.1.0)

1 brief RSS
critical advisory

BuddyPress XProfile Image Field: Arbitrary file deletion (CVE-2026-120518)

The BuddyPress XProfile Image Field plugin for WordPress up to and including version 3.1.0 is vulnerable to arbitrary file deletion via unauthenticated registration metadata.

BuddyPress XProfile Image Field web-application vulnerability arbitrary-file-deletion wordpress
1c