BuddyPress Xprofile Custom Field Types
Avoid: vulnerability published 28 Oct 2026 with no patched version yet.
Capped at 39: a vulnerability has no patch.
| Ownership | 100 |
|---|---|
| Maintenance | 50 |
| Security | 20 |
| Support | No data |
| Reputation | No data |
Quick answers
- Is BuddyPress Xprofile Custom Field Types still maintained?
- Yes. Last release 8 Apr 2026, 3 releases in the last 24 months. 8 Apr 2026 · wordpress.org
- Who owns BuddyPress Xprofile Custom Field Types, and has it changed hands?
- No change recorded. Main committer sbrajesh since May 2018. 3 Nov 2026 · SVN log
- Was BuddyPress Xprofile Custom Field Types removed from wordpress.org?
- No. Listed on wordpress.org as of 3 Nov 2026. 3 Nov 2026 · wordpress.org
- Is BuddyPress Xprofile Custom Field Types safe?
- No. 1 known vulnerability has no fix in the current version. 28 Oct 2026 · Wordfence Intelligence
- Is the latest BuddyPress Xprofile Custom Field Types update safe to install?
- No ownership change before 1.3.1. No one-star spike after it. 8 Apr 2026 · Release history
Active signals
Facts we detected, with links to the source.
- CriticalSEC-1Vulnerability published 28 Oct 2026 with no patched version yet. Disable or replace the plugin until a fix is released.28 Oct 2026Evidence
- WarningMNT-2Tested up to WordPress 6.9.11, 2 major versions behind 7.1.4. Plan a replacement if the plugin is important to your site.3 Nov 2026Evidence
Ownership timeline
Who commits to the plugin's code on wordpress.org, over time.
| sbrajesh | 28 May 2018 to 5 Nov 2026, 44 commits |
|---|---|
| raviousprime | 7 Aug 2023 to 7 Feb 2024, 3 commits |
| pressprogrammer | 16 Jul 2025 to 18 Dec 2025, 3 commits |
3 committers recorded. No ownership change since 2018.
Maintenance
- Last release
- 7 months ago
- Releases, 24 months
- 3
- Tested up to
- 6.9 vs 7.1
- Requires PHP
- 5.3 supported 8.2+
| Q1 2024 | 1 |
|---|---|
| Q2 2024 | 0 |
| Q3 2024 | 0 |
| Q4 2024 | 0 |
| Q1 2025 | 0 |
| Q2 2025 | 0 |
| Q3 2025 | 1 |
| Q4 2025 | 0 |
| Q1 2026 | 1 |
| Q2 2026 | 1 |
| Q3 2026 | 0 |
| Q4 2026 | 0 |
Last release 8 Apr 2026. Tested up to 6.9, 2 major versions behind WordPress 7.1.
Reputation
Last 90 days: no reviews. Lifetime: 4.9.
| 5 star | 14 |
|---|---|
| 4 star | 2 |
| 3 star | 0 |
| 2 star | 0 |
| 1 star | 0 |
Security record
2 vulnerabilities in 24 months, 1 with no fix in the current version.
| Published | Issue | CVSS | Affected | Fixed in | Days to patch |
|---|---|---|---|---|---|
| 28 Oct 2026 | BuddyPress Xprofile Custom Field Types <= 1.3.1 - Authenticated (Subscriber+) PHP Object Injection | 7.5 | <= 1.3.1 | No fix | n/a |
Show 1 patched vulnerability
| Published | Issue | CVSS | Affected | Fixed in | Days to patch |
|---|---|---|---|---|---|
| 5 Jan 2026 | BuddyPress Xprofile Custom Field Types <= 1.2.8 - Authenticated (Subscriber+) Arbitrary File Deletion | 8.8 | <= 1.2.8 | 1.3.0 | Patched before disclosure |
Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.
Support
0% of 1 support threads resolved in the last 2 months.
Momentum
3,000+ active installs. History builds with each weekly snapshot.
| 4 May 2026 | 78 |
|---|---|
| 11 May 2026 | 157 |
| 18 May 2026 | 361 |
| 25 May 2026 | 191 |
| 1 Jun 2026 | 147 |
| 8 Jun 2026 | 131 |
| 15 Jun 2026 | 140 |
| 22 Jun 2026 | 115 |
| 29 Jun 2026 | 104 |
| 6 Jul 2026 | 113 |
| 13 Jul 2026 | 144 |
| 20 Jul 2026 | 123 |
| 27 Jul 2026 | 137 |
| 3 Aug 2026 | 166 |
| 10 Aug 2026 | 125 |
| 17 Aug 2026 | 142 |
| 24 Aug 2026 | 128 |
| 31 Aug 2026 | 131 |
| 7 Sep 2026 | 142 |
| 14 Sep 2026 | 154 |
| 21 Sep 2026 | 154 |
| 28 Sep 2026 | 153 |
| 5 Oct 2026 | 133 |
| 12 Oct 2026 | 177 |
| 19 Oct 2026 | 213 |
| 26 Oct 2026 | 285 |
| 2 Nov 2026 | 47 |
Weekly downloads over the last 4 weeks are 19% above the 27-week average.
Healthier alternatives
Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.
Facts
| Version | 1.3.1 |
|---|---|
| Author | BuddyDev |
| Added | 28 May 2018 |
| Last updated | 8 Apr 2026 |
| Active installs | 3,000+ |
| Requires WordPress | 5.0 |
| Tested up to | 6.9.11 |
| Requires PHP | 5.3 |
| Category | Community & Social > Membership Sites & Subscriptions |
| Tags | fields, xprofile, buddypress, buddypress-profile-field-types |
Other plugins by this author: MediaPress, BuddyPress Activity Shortcode, User Login Notifier for WordPress, Activity Plus Reloaded for BuddyPress, BuddyCommerce: WooCommerce and BuddyPress Integration, BuddyPress Login Redirect to Profile, BuddyPress Notification Widget, BuddyPress Profile Completion, BuddyPress Featured Members, BuddyPress Activity Autoloader, BuddyPress Poke, BP Searchable Activity
Questions
Is BuddyPress Xprofile Custom Field Types still maintained?
Yes. Last release 8 Apr 2026, 3 releases in the last 24 months.
Who owns BuddyPress Xprofile Custom Field Types, and has it changed hands?
No change recorded. Main committer sbrajesh since May 2018.
Was BuddyPress Xprofile Custom Field Types removed from wordpress.org?
No. Listed on wordpress.org as of 3 Nov 2026.
Is BuddyPress Xprofile Custom Field Types safe?
No. 1 known vulnerability has no fix in the current version.
Is the latest BuddyPress Xprofile Custom Field Types update safe to install?
No ownership change before 1.3.1. No one-star spike after it.