Bp Activity Plus Reloaded Vulnerabilities

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddyDev Activity Plus Reloaded for BuddyPress bp-activity-plus-reloaded allows Stored XSS.This issue affects Activity Plus Reloaded for BuddyPress: from n/a through <= 1.1.2.

Affected:

up to 1.1.2

Fix:

No patched version reported

Disclosed:

Oct 27, 2025

CVE-2025-62949 on NVD →

The Activity Plus Reloaded for BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary...

CVSS:

6.4

Affected:

up to 1.1.2

Fix:

No patched version reported

Disclosed:

Oct 12, 2025

CVE-2025-62949 on NVD →

[en] Missing Authorization vulnerability in BuddyDev Activity Plus Reloaded for BuddyPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Activity Plus Reloaded for BuddyPress: from n/a through 1.1.2.

Affected:

up to 1.1.2

Fix:

No patched version reported

Disclosed:

Jun 6, 2025

CVE-2025-30957 on NVD →

The Activity Plus Reloaded for BuddyPress plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 1.1.2

Fix:

No patched version reported

Disclosed:

Jun 5, 2025

CVE-2025-30957 on NVD →

[en] The Activity Plus Reloaded for BuddyPress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.1.1 via the 'ajax_preview_link' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arb...

Affected:

up to 1.1.2

Fixed in:

1.1.2

Disclosed:

Jan 24, 2025

CVE-2024-11913 on NVD →

The Activity Plus Reloaded for BuddyPress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.1.1 via the 'ajax_preview_link' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrar...

CVSS:

5.4

Affected:

up to 1.1.1

Fixed in:

1.1.2

Disclosed:

Jan 23, 2025

CVE-2024-11913 on NVD →