BuddyDev vulnerabilities
We track 2 vulnerabilities in BuddyDev products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on January 6, 2026.
2vulnerabilities
0critical
2high
0exploited
8.2average CVSS score
Latest BuddyDev vulnerabilities
- 8.8 High severity
BuddyPress Xprofile Custom Field Types: Improper Limitation of a Pathname to a Restricted Directory
The BuddyPress Xprofile Custom Field Types plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete_field' function in all versions up to, and including, 1.2.8. This makes it possible for authenticat
- 7.5 High severity
MediaPress: Improper Control of Filename for Include/Require Statement in PHP Program
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BuddyDev MediaPress mediapress allows PHP Local File Inclusion.This issue affects MediaPress: from n/a through <= 1.5.9.1.