BuddyPress XProfile Custom Image Field vulnerabilities
1 known vulnerability in BuddyPress XProfile Custom Image Field from Kalengi. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
1vulnerabilities
1critical
0high
0exploited
9.1average CVSS score
Latest first
- 9.1 Critical severity
BuddyPress XProfile Custom Image Field: Improper Limitation of a Pathname to a Restricted Directory
The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.1.0. This is due to bpxp_image_field_update_on_user_activation() calling unlink() on a path built from visitor-supplied si