Kalengi vulnerabilities
We track 1 vulnerability in Kalengi products. 1 is rated high or critical, and none are known to be exploited. The most recent was published on November 3, 2026.
1vulnerabilities
1critical
0high
0exploited
9.1average CVSS score
Latest Kalengi vulnerabilities
- 9.1 Critical severity
BuddyPress XProfile Custom Image Field: Improper Limitation of a Pathname to a Restricted Directory
The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.1.0. This is due to bpxp_image_field_update_on_user_activation() calling unlink() on a path built from visitor-supplied si