WPML Multilingual for BuddyPress and BuddyBoss Security & Risk Analysis

wordpress.org/plugins/buddypress-multilingual

WPML Multilingual for BuddyPress and BuddyBoss allows BuddyPress and BuddyBoss sites to run fully multilingual using the WPML plugin.

7K active installs v1.9.1 PHP 7.2+ WP 4.7+ Updated Dec 4, 2025
buddybossbuddypressi18nmultilingualwpml
100
A · Safe
CVEs total0
Unpatched0
Last CVENever
Safety Verdict

Is WPML Multilingual for BuddyPress and BuddyBoss Safe to Use in 2026?

Generally Safe

Score 100/100

WPML Multilingual for BuddyPress and BuddyBoss has no known CVEs and is actively maintained. It's a solid choice for most WordPress installations.

No known CVEs Updated 4mo ago
Risk Assessment

The "buddypress-multilingual" plugin v1.9.1 presents a mixed security posture. On the positive side, it demonstrates good practices by utilizing prepared statements for all its SQL queries and shows no history of recorded vulnerabilities, suggesting a generally well-maintained codebase. There are also no observed file operations or external HTTP requests, which mitigates certain attack vectors. However, a significant concern arises from the presence of an unprotected AJAX handler, which represents a direct entry point for potential attacks without proper authentication or authorization checks. The static analysis also indicates that a notable portion of output is not properly escaped, which could lead to cross-site scripting (XSS) vulnerabilities if user-supplied data is not handled rigorously before being displayed.

Key Concerns

  • Unprotected AJAX handler
  • Unescaped output identified
Vulnerabilities
None known

WPML Multilingual for BuddyPress and BuddyBoss Security Vulnerabilities

No known vulnerabilities — this is a good sign.
Code Analysis
Analyzed Mar 16, 2026

WPML Multilingual for BuddyPress and BuddyBoss Code Analysis

Dangerous Functions
0
Raw SQL Queries
0
9 prepared
Unescaped Output
3
6 escaped
Nonce Checks
2
Capability Checks
0
File Operations
0
External Requests
0
Bundled Libraries
0

SQL Query Safety

100% prepared9 total queries

Output Escaping

67% escaped9 total outputs
Attack Surface
1 unprotected

WPML Multilingual for BuddyPress and BuddyBoss Attack Surface

Entry Points1
Unprotected1

AJAX Handlers 1

authwp_ajax_bpml_register_fieldsincludes\class.xprofile.php:49
WordPress Hooks 102
filterbp_get_the_profile_field_multiselect_custom_post_type_selectedincludes\addons\BPXprofileCustomFieldTypes.php:14
filterbp_xprofile_field_multiselect_custom_post_type_valueincludes\addons\BPXprofileCustomFieldTypes.php:15
filterbp_get_the_profile_field_select_custom_post_type_selectedincludes\addons\BPXprofileCustomFieldTypes.php:17
filterbp_xprofile_field_select_custom_post_type_valueincludes\addons\BPXprofileCustomFieldTypes.php:18
filterbp_get_the_profile_field_multiselect_custom_taxonomy_selectedincludes\addons\BPXprofileCustomFieldTypes.php:20
filterbp_get_the_profile_field_select_custom_taxonomy_selectedincludes\addons\BPXprofileCustomFieldTypes.php:21
filterbp_xprofile_set_field_data_pre_validateincludes\addons\BPXprofileCustomFieldTypes.php:23
actionbp_initincludes\class-bpml-compatibility.php:6
filterbpml_redirection_page_idincludes\class-bpml-compatibility.php:13
filterbp_activity_get_join_sqlincludes\class.activities.php:42
filterbp_activity_get_where_conditionsincludes\class.activities.php:43
actioninitincludes\class.activities.php:45
actionbb_topic_after_addedincludes\class.activityTopics.php:12
actionbb_topic_after_updatedincludes\class.activityTopics.php:13
filterbb_topics_prefetch_object_dataincludes\class.activityTopics.php:15
filterbb_get_activity_topic_dataincludes\class.activityTopics.php:16
actionbp_media_album_before_saveincludes\class.albums.php:16
actionbp_media_album_after_saveincludes\class.albums.php:17
filterbp_get_album_titleincludes\class.albums.php:19
filterbp_media_album_prefetch_object_dataincludes\class.albums.php:20
actionbp_document_folder_before_saveincludes\class.documents.php:16
actionbp_document_folder_after_saveincludes\class.documents.php:17
filterbp_get_folder_titleincludes\class.documents.php:19
filterbp_get_folder_folder_titleincludes\class.documents.php:20
filterbp_populate_folder_titleincludes\class.documents.php:21
filterbp_document_folder_breadcrumb_elementincludes\class.documents.php:22
filterbp_document_folder_prefetch_object_dataincludes\class.documents.php:23
filterbp_core_ajax_urlincludes\class.filters.php:16
filtericl_ls_languagesincludes\class.filters.php:18
filterbp_core_get_directory_page_idsincludes\class.filters.php:20
filterbp_core_get_root_domainincludes\class.filters.php:22
filterbp_uriincludes\class.filters.php:23
actionbp_readyincludes\class.filters.php:25
actionbp_initincludes\class.filters.php:27
filterparse_queryincludes\class.filters.php:31
filterbbp_get_forum_idincludes\class.filters.php:44
filterbbp_get_topic_forum_idincludes\class.filters.php:45
filterbbp_get_reply_forum_idincludes\class.filters.php:46
filterbbp_get_topic_idincludes\class.filters.php:49
filterbbp_get_reply_topic_idincludes\class.filters.php:50
filterbbp_get_reply_toincludes\class.filters.php:53
filterbbp_get_reply_idincludes\class.filters.php:54
filterbbp_get_reply_to_idincludes\class.filters.php:55
filtericl_ls_languagesincludes\class.filters.php:203
filterwpml_ls_post_alternative_languagesincludes\class.filters.php:270
actiongroups_group_after_saveincludes\class.groups.php:16
filtergroups_get_groupincludes\class.groups.php:22
filtergroups_get_groupsincludes\class.groups.php:23
filterbp_get_group_description_excerptincludes\class.groups.php:25
filterbp_nouveau_get_group_description_excerptincludes\class.groups.php:26
filterbp_after_groups_edit_base_group_details_parse_argsincludes\class.groups.php:28
filtergroups_get_groupincludes\class.groups.php:158
filterbp_groups_get_group_typesincludes\class.groupTypes.php:34
actionwp_after_insert_postincludes\class.groupTypes.php:37
filterbp_group_organizer_label_textincludes\class.groupTypes.php:38
filterbp_group_moderator_label_textincludes\class.groupTypes.php:39
filterbp_group_member_label_textincludes\class.groupTypes.php:40
actionbefore_delete_postincludes\class.groupTypes.php:46
actionupdated_term_metaincludes\class.groupTypes.php:48
actionadded_term_metaincludes\class.groupTypes.php:49
actiondelete_termincludes\class.groupTypes.php:50
filterwpml_sl_blacklist_requestsincludes\class.members.php:8
filterbp_get_member_typesincludes\class.profileTypes.php:19
actionwp_after_insert_postincludes\class.profileTypes.php:22
actionbefore_delete_postincludes\class.profileTypes.php:23
filterget_post_metadataincludes\class.profileTypes.php:24
actionupdated_term_metaincludes\class.profileTypes.php:27
actionadded_term_metaincludes\class.profileTypes.php:28
actiondelete_termincludes\class.profileTypes.php:29
filterget_post_metadataincludes\class.profileTypes.php:92
actioninitincludes\class.upgrade.php:14
actionbp_initincludes\class.xprofile.php:46
actionxprofile_fields_saved_fieldincludes\class.xprofile.php:52
actionxprofile_fields_deleted_fieldincludes\class.xprofile.php:53
actionxprofile_groups_saved_groupincludes\class.xprofile.php:54
actionxprofile_groups_deleted_groupincludes\class.xprofile.php:55
actionupdate_xprofile_field_metaincludes\class.xprofile.php:56
actionadd_xprofile_field_metaincludes\class.xprofile.php:57
actiondelete_xprofile_field_metaincludes\class.xprofile.php:58
actionupdated_post_metaincludes\class.xprofile.php:59
actionxprofile_data_after_saveincludes\class.xprofile.php:60
filterbp_get_the_profile_field_nameincludes\class.xprofile.php:63
filterbp_get_the_profile_field_alternate_nameincludes\class.xprofile.php:64
filterbp_get_the_profile_field_descriptionincludes\class.xprofile.php:65
filterbp_xprofile_field_get_childrenincludes\class.xprofile.php:66
filterbp_get_the_profile_field_options_checkboxincludes\class.xprofile.php:67
filterbp_get_the_profile_field_options_radioincludes\class.xprofile.php:68
filterbp_get_the_profile_field_options_multiselectincludes\class.xprofile.php:69
filterbp_get_the_profile_field_options_selectincludes\class.xprofile.php:70
filterbp_get_the_profile_field_options_select_genderincludes\class.xprofile.php:71
filterbp_get_the_profile_field_valueincludes\class.xprofile.php:72
filterbp_get_the_profile_group_nameincludes\class.xprofile.php:73
filterbp_get_member_profile_dataincludes\class.xprofile.php:74
actionbp_ps_before_search_formincludes\class.xprofile.php:75
actionadmin_noticesincludes\class.xprofile.php:84
actionadmin_noticessitepress-bp.php:24
actionplugins_loadedsitepress-bp.php:30
actionadmin_noticessitepress-bp.php:35
actioninitsitepress-bp.php:77
filterpage_rewrite_rulessitepress-bp.php:78
filterrewrite_rules_arraysitepress-bp.php:79
actionadmin_noticessitepress-bp.php:102
Maintenance & Trust

WPML Multilingual for BuddyPress and BuddyBoss Maintenance & Trust

Maintenance Signals

WordPress version tested6.9.4
Last updatedDec 4, 2025
PHP min version7.2
Downloads156K

Community Trust

Rating92/100
Number of ratings37
Active installs7K
Developer Profile

WPML Multilingual for BuddyPress and BuddyBoss Developer Profile

Amir Helzer

9 plugins · 108K total installs

82
trust score
Avg Security Score
91/100
Avg Patch Time
53 days
View full developer profile
Detection Fingerprints

How We Detect WPML Multilingual for BuddyPress and BuddyBoss

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/buddypress-multilingual/js/admin.js
Version Parameters
buddypress-multilingual/js/admin.js?ver=

HTML / DOM Fingerprints

JS Globals
BPML_RELPATHBPML_VERSION
FAQ

Frequently Asked Questions about WPML Multilingual for BuddyPress and BuddyBoss