EUVD-2026-100768

The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajaxtemplate' value parsed from the client-controlled 'bpsdirectory' cookie during BuddyPress AJAX directory requests. The bpsdirectoryajax filter hooked onto...

WordPress BP Profile Search plugin <= 5.7.5 - Cross-Site Request Forgery to Cross-Site Scripting vulnerability

Cross-Site Request Forgery to Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin BP Profile Search versions = 5.7.5...

PT-2024-38627

Name of the Vulnerable Software and Affected Versions BP Profile Search plugin for WordPress versions up to, and including, 5.7.5 Description The issue is due to missing or incorrect nonce validation on the bps ajax field selector, bps ajax template options, and bps ajax field row functions. This...

BP Profile Search <= 4.5.3 - PHP Object Injection

The plugin bp-profile-search insecurely trusts serialized data submitted over HTTP requests. This opens up the site to a PHP object injection vulnerability potential exploit vector. This vulnerability was patched in version 4.6, information is being released now as a disclosure period has expired...

WordPress BP Profile Search Plugin <= 4.5.3 - PHP Object Injection

This plugin is prone to a PHP object injection vulnerability. Solution Update the plugin...