BP Profile Search
Healthy: vulnerability published 13 Oct 2026, fixed in 6.0.
| Ownership | 100 |
|---|---|
| Maintenance | 100 |
| Security | 90 |
| Support | 70 |
| Reputation | 70 |
Active signals
Facts we detected, with links to the source.
- WarningSEC-1Vulnerability published 13 Oct 2026, fixed in 6.0. Update to version 6.0 or later.13 Oct 2026Evidence
Ownership timeline
Who commits to the plugin's code on wordpress.org, over time.
| dontdream | 29 Jun 2010 to 10 Oct 2026, 237 commits |
|---|
1 committer recorded. No ownership changes recorded since 3 Nov 2026.
Maintenance
- Last release
- 25 days ago
- Releases, 24 months
- 5
- Tested up to
- 7.1 current
- Requires PHP
- not stated supported 8.2+
| Q1 2024 | 5 |
|---|---|
| Q2 2024 | 1 |
| Q3 2024 | 1 |
| Q4 2024 | 0 |
| Q1 2025 | 3 |
| Q2 2025 | 0 |
| Q3 2025 | 0 |
| Q4 2025 | 0 |
| Q1 2026 | 0 |
| Q2 2026 | 1 |
| Q3 2026 | 0 |
| Q4 2026 | 1 |
Last release 10 Oct 2026. Tested with WordPress 7.1 (current).
Support
100% of 1 support threads resolved in the last 2 months.
Security record
| Published | Issue | CVSS | Affected | Fixed in | Days to patch |
|---|---|---|---|---|---|
| 13 Oct 2026 | BP Profile Search <= 5.9 - Unauthenticated Local File Inclusion to Remote Code Execution via 'bps_directory' Cookie 'ajax_template' Value | 8.1 | <= 5.9 | 6.0 | 0 |
| 19 Aug 2024 | BP Profile Search <= 5.7.5 - Cross-Site Request Forgery to Reflected Cross-Site Scripting | 6.1 | <= 5.7.5 | 5.8 | 0 |
| 17 Jan 2024 | BP Profile Search <= 5.5 - Reflected Cross-Site Scripting via BPS_FORM | 6.1 | <= 5.5 | 5.6 | 0 |
| 9 Dec 2016 | BP Profile Search <= 4.5.3 - PHP Object Injection | 9 | <= 4.5.3 | 4.6 | 0 |
Source: Wordfence Intelligence.
Reputation
Lifetime rating 5.0 from 71 ratings. Quarterly trends appear as new reviews arrive.
| 5 star | 70 |
|---|---|
| 4 star | 1 |
| 3 star | 0 |
| 2 star | 0 |
| 1 star | 0 |
Momentum
5,000+ active installs. History builds with each weekly snapshot.
| 4 May 2026 | 189 |
|---|---|
| 11 May 2026 | 314 |
| 18 May 2026 | 529 |
| 25 May 2026 | 337 |
| 1 Jun 2026 | 257 |
| 8 Jun 2026 | 235 |
| 15 Jun 2026 | 241 |
| 22 Jun 2026 | 210 |
| 29 Jun 2026 | 181 |
| 6 Jul 2026 | 222 |
| 13 Jul 2026 | 234 |
| 20 Jul 2026 | 220 |
| 27 Jul 2026 | 242 |
| 3 Aug 2026 | 253 |
| 10 Aug 2026 | 212 |
| 17 Aug 2026 | 232 |
| 24 Aug 2026 | 260 |
| 31 Aug 2026 | 233 |
| 7 Sep 2026 | 204 |
| 14 Sep 2026 | 318 |
| 21 Sep 2026 | 205 |
| 28 Sep 2026 | 230 |
| 5 Oct 2026 | 1,685 |
| 12 Oct 2026 | 1,094 |
| 19 Oct 2026 | 684 |
| 26 Oct 2026 | 815 |
| 2 Nov 2026 | 90 |
Weekly downloads over the last 4 weeks are 82% above the 27-week average.
Healthier alternatives
Same category, higher Canary Score. Never sponsored.
Facts
| Version | 6.0 |
|---|---|
| Author | Andrea Tarantini |
| Added | 29 Jun 2010 |
| Last updated | 10 Oct 2026 |
| Active installs | 5,000+ |
| Requires WordPress | 6.1 |
| Tested up to | 7.1.4 |
| Requires PHP | not stated |
| Category | Community & Social > Membership Sites & Subscriptions |
| Tags | users, search, members, directory, buddypress |
Other plugins by this author: Menubar, BP Distance Search
Questions
Is BP Profile Search still maintained?
BP Profile Search was last updated on 10 Oct 2026. Its Canary status is Healthy.
Is BP Profile Search safe?
BP Profile Search has no open unpatched vulnerabilities on record. 1 vulnerability was published in the last 24 months. Its Canary status is Healthy.
Who owns BP Profile Search?
The wordpress.org author is Andrea Tarantini. Recent committers: dontdream, plugin-master. We have recorded no ownership change.
What can I use instead of BP Profile Search?
Plugins in the same category with a higher Canary Score: SearchWP Live Ajax Search, ACF: Better Search, WP Search with Algolia, Highlight Search Terms, Jetpack Search.