CVE-2026-120518 - BuddyPress XProfile Image Field <= 3.1.0 - Unauthenticated Arbitrary File Deletion via Signup Image Field Activation Handler
CVE ID :CVE-2026-120518 Published : Nov. 3, 2026, 5:18 a.m. | 1 hour, 45 minutes ago Description :The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.1.0. This is due to...