high8.8
CVE-2026-116868
Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3.1 versions.
Impact
Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3.1 versions.
Affected products
| Product | Affected versions |
|---|---|
| BuddyPress Xprofile Custom Field Types | through 1.3.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.