WordPress BuddyPress Plugin <= 2.7.3 - Arbitrary File Deletion

This plugin is prone to an arbitrary file deletion vulnerability. Solution Update the plugin...

BuddyPress 2.0-2.7.3 - Arbitrary File Deletion

The BuddyPress WordPress plugin was affected by an Arbitrary File Deletion security vulnerability...

WordPress: [Buddypress] Arbitrary File Deletion through bp_avatar_set

Hi, The bpavatarset action in BuddyPress when cropping avatars allows an attacker to arbitrarily delete a file the webserver can delete through the 'originalfile' parameter. For example: Create a user on a Buddypress-powered Wordpress instance any user is OK, doesn't need to be admin, just needs ...

WordPress BuddyPress Plugin <= 2.3.4 - Privilege Escalation

This plugin is prone to authenticated privilege escalation vulnerability. Solution Update the plugin...

BuddyPress <= 2.3.4 - Authenticated Privilege Escalation

According to the vendor, versions 2.0.4, 2.1.2, and 2.2.4 also contain a fix for this vulnerability...

WordPress Plugin BuddyPress Activity Plus 'admin-ajax' Cross-Site Request Forgery Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in the WordPress plugin BuddyPress Activity Plus 'admin-ajax'. An attacker...

WordPress BuddyPress Activity Plus Plugin 1.5 - CSRF

BuddyPress Activity Plus plugin is prone to a cross-site request forgery that allows an attacker to delete any file which PHP process can delete. Solution Upgrade the plugin...

WordPress BuddyPress Activity Plus 1.5 CSRF / File Deletion Vulnerabilities

Exploit for php platform in category web applications Details ================ Software: BuddyPress Activity Plus Version: 1.5 Homepage: http://wordpress.org/plugins/buddypress-activity-plus/ Advisory report:...

WordPress Plugin BuddyPress Activity Plus 1.5 - Cross-Site Request Forgery

WordPress Plugin BuddyPress Activity Plus 1.5 - Cross-Site Request Forgery Details ================ Software: BuddyPress Activity Plus Version: 1.5 Homepage: http://wordpress.org/plugins/buddypress-activity-plus/ Advisory report:...

WordPress Plugin BuddyPress Activity Plus 1.5 - Cross-Site Request Forgery

Details ================ Software: BuddyPress Activity Plus Version: 1.5 Homepage: http://wordpress.org/plugins/buddypress-activity-plus/ Advisory report: https://security.dxw.com/advisories/csrf-and-arbitrary-file-deletion-in-buddypress-activity-plus-1-5/ CVE: Awaiting assignment CVSS: 8.5 High;...

WordPress BuddyPress Activity Plus 1.5 CSRF / File Deletion

Details ================ Software: BuddyPress Activity Plus Version: 1.5 Homepage: http://wordpress.org/plugins/buddypress-activity-plus/ Advisory report: https://security.dxw.com/advisories/csrf-and-arbitrary-file-deletion-in-buddypress-activity-plus-1-5/ CVE: Awaiting assignment CVSS: 8.5 High;...

BuddyPress Activity Plus <= 1.5 - Cross-Site Request Forgery (CSRF)

The BuddyPress Activity Plus WordPress plugin was affected by a Cross-Site Request Forgery CSRF security vulnerability...

WordPress BuddyPress Plugin <= 1.7.1 - Multiple SQL Injections

This plugin is prone to multiple SQL injections. Solution Update the plugin...

WordPress BuddyPress Plugin <= 1.2.9 - SQL Injection

Because of this vulnerability, remote authenticated users can execute arbitrary SQL commands. Solution Update the plugin...

rtMedia for WordPress, BuddyPress & bbPress 3.7.39 - SQL Injection

When initialized, the rtMedia will include and instantiate certain classes if BuddyPress is installed. One of these classes is RTMediaActivityUpgrade, contained within the file ‘app/importers/RTMediaActivityUpgrade.php’. This class is instantiated in the file ‘admin/RTMediaAdmin.php,’ line 110, i...

rtMedia for WordPress, BuddyPress & bbPress 3.7.39 - SQL Injection

When initialized, the rtMedia will include and instantiate certain classes if BuddyPress is installed. One of these classes is RTMediaActivityUpgrade, contained within the file ‘app/importers/RTMediaActivityUpgrade.php’. This class is instantiated in the file ‘admin/RTMediaAdmin.php,’ line 110, i...

BuddyPress Extended Friendship Request - wp-admin/admin-ajax.php friendship_request_message Parameter XSS

The BuddyPress Extended Friendship Request WordPress plugin was affected by a wp-admin/admin-ajax.php friendshiprequestmessage Parameter XSS security vulnerability...

BuddyPress 1.7.1 - Multiple SQL Injections

The BuddyPress WordPress plugin was affected by a Multiple SQL Injections security vulnerability...

Buddypress <= 1.9.1 - Stored Cross-Site Scripting (XSS)

The BuddyPress WordPress plugin was affected by a Stored Cross-Site Scripting XSS security vulnerability...

Buddypress <= 1.9.1 - Crafted bp_new_group_id Cookie Arbitrary Group Manipulation

The BuddyPress WordPress plugin was affected by a Crafted bpnewgroupid Cookie Arbitrary Group Manipulation security vulnerability...