CVE-2026-120518 | kalengi BuddyPress XProfile Custom Image Field Plugin up to 3.1.0 on WordPress XProfile Image Field bpxp_image_field_update_on_user_activation field_N_hidden path traversal

A vulnerability was found in kalengi BuddyPress XProfile Custom Image Field Plugin up to 3.1.0 on WordPress. It has been declared as critical. Affected by this issue is the function bpxp_image_field_update_on_user_activation of the component XProfile Image Field. Executing a manipulation of the argument field_N_hidden can lead to path traversal.

This vulnerability is handled as CVE-2026-120518. The attack can be executed remotely. There is not any exploit available.VulDB Recent EntriesRead More