Bp Profile Shortcodes Extra Vulnerabilities

The BP Profile Shortcodes Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scrip...

CVSS:

6.4

Affected:

up to 2.6.0

Fix:

No patched version reported

Disclosed:

Jan 7, 2025

CVE-2025-22817 on NVD →

The BP Profile Shortcodes Extra plugin for WordPress is vulnerable to time-based SQL Injection via the ‘tab’ parameter in all versions up to, and including, 2.6.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authent...

CVSS:

6.5

Affected:

up to 2.6.0

Fix:

No patched version reported

Disclosed:

Dec 2, 2024

CVE-2024-11732 on NVD →

The BP Profile Shortcodes Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scrip...

CVSS:

6.4

Affected:

up to 2.5.2

Fixed in:

2.5.3

Disclosed:

Nov 15, 2023

CVE-2023-47815 on NVD →