plugin

Buddypress Activity Plus Vulnerabilities

1 known security issue reported for the Buddypress Activity Plus WordPress plugin. Most recent disclosed Jul 14, 2015.

1 high

Running Buddypress Activity Plus on your site? Check whether your installed version is affected.

Scan your site free

BuddyPress Activity Plus <= 1.5 - Cross-Site Request Forgery

high

The buddypress-activity-plus plugin before 1.6.2 for WordPress has CSRF with resultant directory traversal via the wp-admin/admin-ajax.php bpfb_photos[] parameter in a bpfb_remove_temp_images action.

CVSS:: 8.8
Affected:: up to 1.5
Fixed in:: 1.6.2
Disclosed:: Jul 14, 2015

CVE-2015-9455 on NVD →

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database