Advisories · Technology

kalengi BuddyPress XProfile Custom Image Field.

Every CVE that names kalengi BuddyPress XProfile Custom Image Field among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-120518 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

BuddyPress XProfile Image Field <= 3.1.0 - Unauthenticated Arbitrary File Deletion via Signup Image Field Activation Handler
- kalengi BuddyPress XProfile Custom Image Field
- Path traversal
Not analysed yet 3 Nov 2026