Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-06-17
Bp Activity Plus Reloaded - Cross-Site Scripting (XSS) (CVE-2025-62949)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddyDev Activity Plus Reloaded for BuddyPress bp-activity-plus-reloaded allows Stored XSS.This issue affects Activity Plus Reloaded for BuddyPress: from n/a through
PLUGIN
Bp Activity Plus Reloaded
CVE-2025-62949
Risk Score
Threat Entry
Updated 2026-06-17
Bp Activity Plus Reloaded - Broken Access Control (CVE-2025-30957)
Missing Authorization vulnerability in BuddyDev Activity Plus Reloaded for BuddyPress bp-activity-plus-reloaded allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Activity Plus Reloaded for BuddyPress: from n/a through
PLUGIN
Bp Activity Plus Reloaded
CVE-2025-30957
Risk Score
Threat Entry
Updated 2026-06-17
Bp Activity Plus Reloaded - Server-Side Request Forgery (SSRF) (CVE-2024-11913)
The Activity Plus Reloaded for BuddyPress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.1.1 via the 'ajax_preview_link' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
PLUGIN
Bp Activity Plus Reloaded
CVE-2024-11913
Risk Score