Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?BuddyPressbuddypress-mediaYouzify – BuddyPress Community, User Profile, Social Network & Membership Plugin forpush-notification-for-post-and-buddypressBetter Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBossActivity Plus Reloaded for BuddyPressBuddyPress WooCommerce My Account Integration. Create WooCommerce Member PagesBuddyPress Docs
Plugin · buddypress-media
buddypress-media
16 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 14, 2026rtMedia for WordPress, BuddyPress and bbPress: Does not verify that a user owns or may write to the album an upload is assigned toCVE-2026-88927 · fixed in 4.7.14 · reported by WPScanMedium 4.3
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.14 does not verify that a user owns or may write to the album an upload is assigned to, allowing users with a subscriber-level account or above to place media into another user's private album and have it attributed to that user.
Oct 10, 2026rtMedia for WordPress, BuddyPress and bbPress: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-105892 · affects up to 4.7.13 · reported by PatchstackCritical 9.8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Path Traversal.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.7.13.
Oct 10, 2026rtMedia for WordPress, BuddyPress and bbPress: Limited file deletionCVE-2026-89301 · affects up to 4.7.13 · reported by WordfenceHigh 7.5
The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in the process function in all versions up to, and including, 4.7.13 This makes it possible for unauthenticated attackers to delete arbitrary safe files on the server.. The public nonce (rtmedia_upload_nonce) is emitted into frontend JavaScript on any page rendering the rtMedia gallery or upload shortcode, making it retrievable by unauthenticated visitors without any prior authentication or privileged action.
Sep 13, 2026rtMedia for WordPress, BuddyPress and bbPress: Does not check ownership before changing the privacy level of an activity and its attached mediaCVE-2026-88912 · fixed in 4.7.12 · reported by WPScanMedium 4.2
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media, relying only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to make another user's private activity public or hide it.
Sep 12, 2026rtMedia for WordPress, BuddyPress and bbPress: Time-based blind SQL InjectionCVE-2026-16482 · affects up to 4.7.11 · reported by WordfenceHigh 7.5
The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'compare' parameter in all versions up to, and including, 4.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is exploitable on any public page containing an rtMedia shortcode (e.g., [rtmedia_gallery]) when the rtmedia_shortcode GET parameter is set, because RTMediaQuery::query() merges $_REQUEST into the internal query while only validating top-level array keys, allowing the nested 'compare' subvalue to reach the vulnerable sink without authentication.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 20, 2026rtMedia for WordPress, BuddyPress and bbPress: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-66592 · affects up to 4.7.11 · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Blind SQL Injection.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.7.11.
Jul 27, 2026Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions.CVE-2026-59551 · affects up to 4.7.10 · reported by PatchstackHigh 8.5
Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions.
Jul 27, 2026Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions.CVE-2026-59549 · affects up to 4.7.10 · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions.
Jul 10, 2026rtMedia for WordPress, BuddyPress and bbPress: Time-based SQL InjectionCVE-2026-15287 · affects up to 4.6.18 · reported by WordfenceMedium 6.5
The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based SQL Injection via the order_by parameter in all versions up to, and including, 4.6.18 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Jun 15, 2026Subscriber Broken Access Control in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.9 versions.CVE-2026-40773 · affects up to 4.7.9 · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.9 versions.
Feb 19, 2026rtMedia for WordPress, BuddyPress and bbPress: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-25325 · affects up to 4.7.8 · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in rtCamp rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Retrieve Embedded Sensitive Data.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through <= 4.7.8.
Dec 13, 2025rtMedia for WordPress, BuddyPress and bbPress: To Information DisclosureCVE-2025-9218 · affects 4.7.0 to 4.7.3 · reported by WordfenceLow 3.7
The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to to Information Disclosure due to missing authorization in the handle_rest_pre_dispatch() function when the Godam plugin is active, in versions 4.7.0 to 4.7.3. This makes it possible for unauthenticated attackers to retrieve media items associated with draft or private posts.
Dec 13, 2024rtMedia for WordPress, BuddyPress and bbPress: Missing AuthorizationCVE-2023-41951 · affects up to 4.6.14 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in rtCamp rtMedia for WordPress, BuddyPress and bbPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.6.14.
Apr 22, 2024rtMedia for WordPress, BuddyPress and bbPress: Blind SQL InjectionCVE-2024-3293 · affects up to 4.6.18 · reported by WordfenceHigh 8.8
The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to blind SQL Injection via the rtmedia_gallery shortcode in all versions up to, and including, 4.6.18 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Dec 26, 2023rtMedia for WordPress, BuddyPress and bbPress: Loads the contents of the import file in an unsafe mannerCVE-2023-5939 · fixed in 4.6.16 · reported by WPScanHigh 7.2
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.6.16 loads the contents of the import file in an unsafe manner, leading to remote code execution by privileged users.
Dec 26, 2023rtMedia for WordPress, BuddyPress and bbPress: Does not validate files to be uploadedCVE-2023-5931 · fixed in 4.6.16 · reported by WPScanHigh 8.8
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.6.16 does not validate files to be uploaded, which could allow attackers with a low-privilege account (e.g. subscribers) to upload arbitrary files such as PHP on the server
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.